Listen to this Post
Introduction: When Trust Becomes the Most Dangerous Vulnerability
For years, cybersecurity professionals have warned users not to click suspicious links or download unknown files. But what happens when the message doesn’t come from a stranger? What happens when it arrives from a colleague you’ve worked with, a business partner you’ve met in person, or a trusted Web3 developer you’ve spoken with countless times?
That is exactly the strategy behind the latest campaign conducted by BlueNoroff, a financially motivated North Korean cyber-espionage group that operates under the broader Lazarus ecosystem. Instead of relying on spam emails or fake social media profiles, the attackers are hijacking legitimate Telegram accounts and transforming real victims into unwilling accomplices.
Recent research from JUMPSEC exposes one of the most sophisticated phishing platforms seen in the cryptocurrency sector. By combining stolen Telegram accounts, fake Zoom and Microsoft Teams meetings, AI-generated video participants, ClickFix social engineering, and malware designed for both Windows and macOS, BlueNoroff has created a cyberattack chain that spreads through trust rather than deception alone.
A Sophisticated Attack Designed for the Web3 Industry
BlueNoroff continues to focus heavily on cryptocurrency companies, blockchain developers, NFT projects, DeFi platforms, venture capital firms, and organizations managing digital assets.
Unlike traditional phishing campaigns that rely on mass distribution, this operation is highly targeted.
The attackers first compromise a legitimate Telegram account belonging to someone inside the cryptocurrency ecosystem. Once inside, they patiently monitor conversations and professional relationships before selecting the next victim.
Because every new target already trusts the compromised account owner, the attackers eliminate one of the biggest obstacles faced by conventional phishing attacks: skepticism.
The result is a self-expanding attack chain where every successful compromise becomes another launch point for future victims.
Telegram Becomes the Primary Attack Gateway
Telegram has become an essential communication platform for the cryptocurrency industry.
Developers, investors, founders, security researchers, and exchange employees communicate daily through Telegram channels and private chats.
BlueNoroff exploits this dependence.
Instead of creating fake accounts, the attackers inherit years of legitimate conversations after stealing a user’s session or credentials.
Victims often receive meeting invitations from someone they genuinely know.
In several documented incidents, researchers found that victims had previously met the sender in person, making the fraudulent invitation appear completely legitimate.
This dramatically increases the likelihood of successful compromise.
The Fake Zoom and Microsoft Teams Meeting
The campaign begins with what appears to be an ordinary invitation to join a Zoom or Microsoft Teams meeting.
The invitation links to carefully crafted typosquatted domains that closely resemble legitimate conferencing services.
At first glance, even experienced users may fail to notice the subtle spelling differences.
After opening the webpage, the victim is asked to enter a username and grant webcam permissions.
Everything appears authentic.
Behind the scenes, however, the phishing infrastructure streams the victim’s webcam feed directly to attacker-controlled servers through WebRTC technology.
Meanwhile, the victim waits inside a fake meeting lobby.
AI-Generated Meeting Participants Increase Credibility
One of the most disturbing aspects of the campaign is its use of staged video meetings.
Instead of conducting a live conversation, the attackers display pre-recorded video footage.
Researchers believe AI-generated faces are overlaid onto previously recorded body movements, creating convincing participants who resemble real industry contacts.
The fake attendee briefly appears before claiming there is an audio issue.
Rather than continuing the conversation, they instruct the victim to install what appears to be a required Zoom or Microsoft Teams SDK update.
This psychological trick lowers suspicion because technical issues during online meetings are common.
ClickFix Social Engineering Delivers the Malware
The supposed software update is entirely fake.
Victims receive instructions telling them to copy and execute a command.
Although the displayed text appears harmless, the webpage secretly replaces the clipboard contents with a malicious ClickFix payload.
Instead of copying legitimate instructions, victims unknowingly execute attacker-controlled commands.
This bypasses many conventional download warnings because users voluntarily execute the malicious command themselves.
The social engineering is subtle, believable, and remarkably effective.
PowerShell Loader Opens the Door
On Windows systems, the copied command launches a compact PowerShell loader.
The loader retrieves a malicious VBScript payload from attacker-controlled infrastructure.
Before executing the malware, it modifies Microsoft Defender by creating exclusion rules.
It then restarts Defender so those changes immediately become active.
With built-in protections weakened, the downloaded malware executes with significantly fewer obstacles.
Trojan.NukeSped Returns
Researchers identified one recovered payload as Trojan.NukeSped, malware that has previously been linked to Lazarus operations.
Once active, the malware performs extensive reconnaissance.
It gathers:
System information
Windows version
CPU architecture
Network configuration
Running processes
Installed browser extensions
User profile information
Additional operating environment data
This intelligence helps attackers determine whether the infected machine belongs to a valuable cryptocurrency target.
Telegram Session Theft Enables Self-Propagation
Perhaps the most dangerous capability discovered during the investigation involves Telegram session harvesting.
The malware searches browser profile directories for Telegram Web IndexedDB data across multiple browsers, including Chrome, Microsoft Edge, Brave, and Firefox.
If active Telegram sessions are discovered, attackers may steal authentication data instead of requiring usernames and passwords.
This allows them to immediately access another trusted Telegram account.
That newly compromised account is then used to contact additional people.
Every successful infection creates multiple opportunities for future attacks.
Researchers observed this propagation model in multiple real-world cases.
A Self-Sustaining Cyberattack Ecosystem
Traditional phishing campaigns typically end after compromising a victim.
BlueNoroff’s infrastructure works differently.
Every compromised professional network becomes another distribution channel.
Instead of purchasing spam lists, attackers inherit trusted relationships that have often taken years to establish.
This significantly reduces detection while dramatically increasing success rates.
The campaign behaves more like an expanding ecosystem than a single malware infection.
Indicators of Compromise (IOCs)
Researchers identified several malicious PowerShell loaders associated with the campaign.
PowerShell Loader (Zoom-themed)
SHA-256:
7a0b96f1063593a2e76f2f92ddfe091776a2ba63bc4f87f83dc5ebb675309d8d
PowerShell Loader (weekly-up.online)
SHA-256:
180f797723bd65e82189eb1f737d39ce522614a182e2b46b51faeb49953a412f
Security researchers intentionally defanged all published domains and IP addresses to prevent accidental interaction. Analysts should only re-enable these indicators inside controlled environments such as SIEM platforms, MISP, or VirusTotal.
Deep Analysis
BlueNoroff demonstrates a major evolution in social engineering by combining identity theft, AI-assisted impersonation, and malware delivery into a seamless attack chain. Rather than exploiting software vulnerabilities first, the attackers exploit human trust, then leverage legitimate administrative tools already present on Windows. This approach reduces dependence on exploit kits and increases the likelihood of bypassing traditional security controls.
The campaign also highlights a growing trend where attackers target communication platforms instead of email. Telegram, Discord, Slack, and other collaboration tools are becoming primary attack surfaces because they contain trusted business relationships and active conversations.
Defensive Commands for Security Teams
Review Microsoft Defender exclusions
Get-MpPreference | Select-Object -ExpandProperty ExclusionPath Get-MpPreference | Select-Object -ExpandProperty ExclusionProcess
Check PowerShell Operational Logs
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational"
List recently executed PowerShell commands
Get-History
Detect suspicious scheduled tasks
schtasks /query /fo LIST /v
Inspect active network connections
netstat -ano
Review startup persistence
wmic startup get Caption,Command
Check Defender status
Get-MpComputerStatus
Hunt for suspicious PowerShell execution
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688}
Organizations should also enforce multi-factor authentication, deploy endpoint detection and response (EDR), monitor clipboard-based attack techniques, restrict unnecessary PowerShell execution, and educate employees to verify meeting requests through a second communication channel before executing any commands.
What Undercode Say:
BlueNoroff is no longer relying on technical exploits alone; it is weaponizing professional relationships.
The campaign proves that identity has become the new attack surface.
Compromised Telegram accounts are significantly more valuable than fake phishing accounts.
AI-generated meeting participants represent the next generation of social engineering.
Traditional phishing awareness training is becoming less effective against trusted-contact attacks.
Video conferencing platforms are increasingly being abused as psychological attack vectors.
Clipboard hijacking remains one of the most underestimated techniques in enterprise environments.
PowerShell continues to be one of the most abused administrative tools by advanced threat actors.
Organizations should closely monitor Microsoft Defender configuration changes.
Browser session theft is becoming more valuable than credential theft.
Telegram session tokens provide attackers with immediate persistence.
The cryptocurrency industry remains one of North Korean threat actors’ highest-priority targets.
Supply chain trust is now extending into communication platforms.
Human verification alone is no longer sufficient.
Real-time behavioral monitoring becomes increasingly important.
Zero Trust principles should apply to messaging applications as well.
Meeting invitations should always be independently verified.
Security awareness programs must include collaboration platform threats.
AI-generated impersonation will continue improving.
Deepfake-assisted attacks will become increasingly difficult to recognize.
Identity compromise often causes more damage than malware itself.
Attackers increasingly invest time instead of exploiting software vulnerabilities.
Patience has become a powerful offensive weapon.
Professional networking platforms are valuable intelligence sources.
Operational security inside cryptocurrency companies requires constant evolution.
Incident response teams should preserve browser profile artifacts.
Threat hunting should include Telegram Web session analysis.
Organizations should audit browser extension permissions regularly.
PowerShell logging should remain enabled.
Behavior analytics can detect unusual communication patterns.
Credential theft is evolving into session theft.
Cloud identities require stronger protection than ever before.
Security teams should assume trusted accounts can become malicious.
Every collaboration platform represents a potential lateral movement channel.
AI will accelerate both offensive and defensive cybersecurity capabilities.
Continuous monitoring is more valuable than periodic auditing.
Threat intelligence sharing remains essential across the cryptocurrency ecosystem.
BlueNoroff continues demonstrating exceptional operational patience.
Future campaigns will likely automate even more of the victim acquisition process.
The cybersecurity community must adapt faster than adversaries evolve.
Trust should always be verified—even when it comes from a familiar face.
✅ Confirmed: BlueNoroff has long been associated with financially motivated operations targeting cryptocurrency organizations and is widely linked to the Lazarus ecosystem by multiple cybersecurity vendors.
✅ Confirmed:
✅ Confirmed: The reported malware behavior—including PowerShell execution, Microsoft Defender exclusion changes, Telegram session harvesting, and the use of Trojan.NukeSped—is consistent with previously observed Lazarus tradecraft, although individual techniques may evolve over time as the group updates its tooling.
Prediction
(+1) Defensive technologies will increasingly integrate behavioral AI capable of identifying fake meetings, deepfake participants, abnormal collaboration activity, and suspicious clipboard manipulation before malware execution occurs.
(-1) North Korean threat actors and other advanced cybercriminal groups are likely to expand this trusted-contact model beyond Telegram, targeting Slack, Discord, Signal, Microsoft Teams, and other collaboration platforms with increasingly convincing AI-generated identities, making social engineering more difficult to detect than ever before.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
