Researchers warn that a financially motivated unit of North Korea’s Lazarus Group has been running a social-engineering campaign that uses fake Zoom or Teams calls against senior-level executives in cryptocurrency and blockchain.
The threat actor, tracked as BlueNoroff, targeted a legal executive at an international consulting firm with a Calendly calendar invite that contained a typo-squatted Zoom link. This led to exfiltration of meeting footage from live camera feeds, according to a Monday blog post from Arctic Wolf.
The hackers targeted about 100 different executives spread across more than 20 countries. About 40% of the victims were based in the U.S., with Singapore and the U.K. also among the most targeted countries. The targets included decentralized finance founders, exchange operators, blockchain wallet developers and others, according to Arctic Wolf researchers.
Individuals were targeted due to their “direct access to private keys, wallet infrastructure, and exchange administration” panels, demonstrating the goal to be able to access to crypto wallets.
Researchers said the hackers conducted deep reconnaissance on selected targets to make the attacks more credible.
“The attackers appear to have conducted detailed investigative work prior to setting up each fake meeting,” Ismael Valenzuela, VP of threat intelligence at Arctic Wolf, told Cybersecurity Dive. “The attacker's ability to populate a fake Zoom or Teams call with recognizable industry figures, tailored to the specific target’s professional network, represents a potent social engineering capability on behalf of the threat actor.”
More than 80 typo-squatted Zoom or Teams domains were registered over a five-month period starting in late 2025. Researchers also analyzed about 950 files from the attacker infrastructure, which showed how stolen web footage was combined with AI-generated images to create fabricated content for future social engineering attacks.
The activity appears consistent with previously documented BlueNoroff activity. Researchers at Huntress and Kaspersky have researched earlier threat campaigns targeting Web3 organizations.
The Huntress blog documented a 2025 social engineering attack based on a single endpoint intrusion. Huntress officials said the campaign outlined by Arctic Wolf demonstrates a major escalation in capabilities.
Jon Semon, principal security operations analyst at Huntress told Cybersecurity Dive, “I can say with confidence that BlueNoroff has grown substantially in the six to eight months since our [research], in terms of tooling, infrastructure, malware development, and overall attack volume.”
