The Attack Chain

BLUENOROFF, a North Korean state-sponsored threat actor, is currently executing a sophisticated campaign that weaponizes fake Zoom and Telegram applications to steal cryptocurrency assets. The attack specifically targets Web3 executives, CEOs, and founders through a "self-reinforcing" social engineering pipeline that uses compromised accounts to lure new victims into fraudulent video meetings [Source: https://arcticwolf.com/resources/blog/bluenoroff-fake-zoom-telegram-attack-campaign/].

The Attack Chain

The campaign follows a multi-stage process designed to bypass traditional security measures:

1. Initial Contact: Attackers use compromised Telegram accounts of previous victims to reach out to their professional networks. They often schedule meetings weeks in advance via Calendly to build legitimacy [Source: https://arcticwolf.com/resources/blog/bluenoroff-fake-zoom-telegram-attack-campaign/].
2. The "Meeting" Bait: Shortly before the scheduled call, the attacker replaces a legitimate meeting link with a typo-squatted Zoom or Teams URL (e.g., uu03webzoom[.]us) [Source: https://arcticwolf.com/resources/blog/bluenoroff-fake-zoom-telegram-attack-campaign/].
3. Deepfake Meeting Lobby: Victims land on a fake lobby featuring AI-generated avatars (created via GPT-4o) and deepfake composite videos of previous victims to simulate a real meeting environment [Source: https://arcticwolf.com/resources/blog/bluenoroff-fake-zoom-telegram-attack-campaign/].
4. ClickFix Infection: The fake app displays a "broken" audio/video state and prompts the victim to run a "fix" command. This is a ClickFix-style prompt that tricks the victim into running an obfuscated PowerShell script [Source: https://arcticwolf.com/resources/blog/bluenoroff-fake-zoom-telegram-attack-campaign/].
5. Malware Execution: The script executes fileless malware in-memory to evade antivirus. It establishes a C2 connection to steal browser credentials, hijack Telegram sessions (tdata), and fingerprint MetaMask or other crypto wallet extensions [Source: https://jumpsec.com/bluenoroff-phishing-kit-evolution-july-2026/].

Key Campaign Metrics & Indicators

Malware Capabilities

The malware deployed through these fake applications is highly specialized for crypto theft:

• Wallet Fingerprinting: The kit scans for specific extension IDs (MetaMask, etc.) across Chrome, Edge, Brave, and other browsers to prioritize high-value targets [Source: https://jumpsec.com/bluenoroff-phishing-kit-evolution-july-2026/].
• Credential Theft: It extracts saved passwords and session cookies to gain access to exchange accounts and private keys [Source: https://arcticwolf.com/resources/blog/bluenoroff-fake-zoom-telegram-attack-campaign/].
• Stealthy Exfiltration: It uses System.Windows.Forms to capture in-memory screenshots, which are then sent via the Telegram Bot API to avoid detection by network monitoring tools [Source: https://arcticwolf.com/resources/blog/bluenoroff-fake-zoom-telegram-attack-campaign/].

While the general mechanics of the campaign are well-documented, specific metrics regarding the total number of events and exact persistence durations lack broad independent verification beyond initial research reports. Users are advised to never run "fix" commands or scripts provided during video meeting lobbies.