BlueNoroff: a Zoom kit tailored for crypto, with live AI deepfake video

The North Korean group BlueNoroff (Lazarus) has been operating a Zoom/Teams phishing kit since May 2026 that compromises legitimate Telegram accounts, invites targets to a fake meeting, captures their webcam, overlays an AI deepfake (ChatGPT), profiles installed crypto wallets, and then pushes malware via ClickFix. Five versions of the kit documented by JUMPSEC.

yesterday 8 2