North Korea's BlueNoroff Uses Fake Zoom and Teams Calls to Drain Crypto Wallets in Under Five Minutes

Researchers have documented a campaign by BlueNoroff, a subgroup of the North Korea-linked Lazarus Group, that uses routine video calls to steal cryptocurrency. As French-language outlet Goku Crypto News reported, the group targets crypto professionals using compromised Telegram accounts to send invitations to fake Zoom and Microsoft Teams meetings.

The method is deliberate. BlueNoroff registers domains that closely resemble legitimate meeting platforms, a technique known as typosquatting, and has created more than 80 such lookalike domains since late 2025. Before delivering any malware, the group's phishing kit scans a victim's browser for installed wallets, then decides which targets are worth infecting. Reports indicate the attackers now use AI-generated avatars and deepfake composites to make the fake meetings more convincing, and released five versions of the kit between May 31 and July 14.

The operation has reached more than 100 victims across over 20 countries, with 41% of targets in the United States, and researchers say some victims are compromised in under five minutes. This attack does not exploit a smart-contract bug. It compromises the device and the private keys stored there, a separate attack surface from the on-chain exploits that dominate loss tallies.

The root cause is social engineering combined with endpoint compromise. Once private keys are harvested, no protocol audit protects the holder.