North Korean Hackers Run Fake Zoom and Teams Sites to Rob Crypto Wallets
BlueNoroff's phishing kit screens visitors' crypto wallets before deciding who gets the malware, researchers say.
Key points
- BlueNoroff, a hacking crew linked to North Korea, is running fake Zoom and Microsoft Teams login pages to trick finance and crypto staff into installing malware.
- The phishing kit checks a visitor's browser for cryptocurrency wallet extensions before serving the payload, so only useful targets get infected.
- Attackers are using real, hijacked industry contacts to make meeting invites look genuine.
- The campaign is part of the wider ClickFix trend, where victims are told to paste a "fix" command into their own computer.
A North Korean hacking group known as BlueNoroff is running a phishing operation that impersonates Zoom and Microsoft Teams, then quietly checks whether the victim owns cryptocurrency before infecting them.
The campaign was detailed by researchers and first reported by The Hacker News. It fits inside a broader wave of attacks known as ClickFix, where victims are walked through pasting a malicious command into their own machine under the guise of fixing a broken meeting. Lazarus, the umbrella cluster that BlueNoroff belongs to, has been a recurring subject here: we first covered it on 3 July 2026, and this is the fifth Lazarus-linked story we've published in the past 90 days.
How does the scam actually work?
Victims get a meeting invite from what looks like a real business contact. The link points to a typosquatted domain, a web address that copies a real one with a small spelling change. Mimicking the Zoom or Teams join screen, the fake page waits.
When the meeting "fails", the site tells the user to run a short command to repair audio or video. That command downloads BlueNoroff's malware.
Here's the twist. Before handing over any malicious code, the site runs a browser check for cryptocurrency wallet extensions such as MetaMask or Phantom. No wallet found means a harmless error. Wallet detected means the attack proceeds.
That filtering keeps the operation quiet. Security researchers who stumble onto the page see nothing suspicious. Only real targets get burned.
Who is BlueNoroff and why crypto?
BlueNoroff is a sub-group of the Lazarus cluster, tied to North Korea's government. Its job, according to years of tracking by the FBI and the United Nations, is to steal money to fund the regime. Crypto theft has become its main line of work.
US authorities have attributed hundreds of millions of dollars in cryptocurrency theft to North Korean operators over the past two years, including the Bybit intrusion in 2025.
What does the phishing kit look like on the inside?
| Element | Detail |
|---|---|
| Impersonated brands | Zoom, Microsoft Teams |
| Delivery trick | ClickFix-style "paste this command" prompt |
| Pre-infection check | Browser scan for crypto wallet extensions |
| Lure source | Hijacked real industry contacts and meeting threads |
| Attributed group | BlueNoroff (Lazarus sub-cluster, DPRK) |
Compromised, genuine business contacts are what make this hard to spot. The invite doesn't come from a stranger. It comes from someone the victim has emailed before, on a topic they were already discussing, and that's a social engineering angle North Korean operators have now used across multiple campaigns we've tracked.
What should staff and crypto holders do?
Treat every "click here to fix your meeting" instruction as hostile. Zoom and Teams don't ask you to open a terminal or run a PowerShell command to join a call. If a meeting link fails, close the tab and rejoin from the official app.
Check the domain first. Real Zoom links sit on zoom.us; real Teams links sit on teams.microsoft.com or teams.live.com. Extra words, unusual endings or added hyphens are a warning.
If you handle crypto at work, keep signing wallets on a separate device from the one you use for email. Cold storage is boring. It's also what saves you here.
Regulatory jurisdiction on the victim side will depend on where stolen funds and personal data sit. In the US that pulls in the FBI and the SEC for any listed firm losing material assets; in the UK the ICO would expect a breach notification if employee or customer data was taken alongside the crypto.
The thing worth watching isn't the malware itself but the wallet-screening step. Operators who filter their victims that precisely before deploying a payload are running a disciplined, long-game operation, not a spray-and-pray campaign. That selectivity is what keeps the infection rate low enough to avoid early detection.
