It’s the most counterintuitive thing you’ll read today: the Zoom phishing kit isn’t just stealing credentials, it’s inventorying victims’ cryptocurrency wallets before dropping the payload. That twist comes from a North Korean threat cluster JUMPSEC identified as BlueNoroff, and it changes how we think about social‑engineering attacks.
Key Takeaways
- BlueNoroff combines compromised contacts, Telegram hijacking, and wallet reconnaissance into a repeatable acquisition pipeline.
- The fake Zoom and Microsoft Teams pages steal webcam feeds via mediasoup WebRTC and then serve AI‑generated video composites.
- Windows attacks disable Microsoft Defender, add C:\Users to exclusion paths, and probe extensions for wallet add‑ons like MetaMask.
- Teams‑variant lures are more polished, supporting emoji reactions and advanced wallet probes before malware delivery.
- Victims’ Telegram sessions can be stolen and reused against their own contacts, creating a self‑propagating chain.
Zoom phishing kit uses trusted contacts and Telegram
JUMPSEC says BlueNoroff “has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet reconnaissance and malware delivery into a repeatable victim acquisition pipeline.” That’s not hype; the group actually hijacks legitimate Telegram accounts belonging to people in the crypto space. The attackers then message high‑ranking employees of major firms, slipping a Calendly link that masquerades as a Zoom meeting invite.
Because the link comes from an account the target already trusts and has met in real life, the social‑engineering vector works like a charm. When the victim clicks, they’re taken to a fake domain that looks exactly like Zoom’s login page. The page asks for a name and webcam permission, then streams the feed straight to the operators’ panel via mediasoup WebRTC.
“Every victim who runs the payload with Telegram Web open or Telegram Desktop installed is a candidate for their Telegram session to be stolen and reused against their own contacts,” JUMPSEC said.
That quote sums up why the campaign is so dangerous. Once the attacker hijacks a Telegram session, they can impersonate the victim and send the same lure to the victim’s contacts, turning each compromised account into a new launchpad.
How the fake meeting tricks victims
After the webcam permission is granted, the victim sees a page that claims to be a Zoom meeting. The interface shows a “waiting for other participants” message, buying the attacker time to set up the next stage. When the meeting finally “starts,” the victim sees a video that looks like a live call, but it’s actually a pre‑edited clip.
The video features AI‑generated headshots created using OpenAI’s ChatGPT, superimposed over authentic body movements captured from previous meetings. JUMPSEC explains, “So, each successful attack feeds source material into the composites used against the next target.” That means the fake face can look familiar, moving in a way that matches the victim’s expectations.
Because the operator controls the panel, they can send fake “your mic isn’t working” messages and even trigger a “Zoom SDK Update,” which ultimately drops the ClickFix payload onto the victim’s machine.
Windows kill chain details
The Windows version of the attack chain is a multi‑stage nightmare. First, the ClickFix command launches a PowerShell loader that downloads and runs a VBScript. The script disables Microsoft Defender, adds C:\Users to the exclusion path, and forces a restart of Defender so the exclusions stick.
Next, the VBScript scans for Telegram Web‑related files across Chrome, Edge, Brave, and Firefox profile directories. The goal is to see if the victim has an active Telegram session and, if so, hijack the session cookies.
Afterward, the implant enumerates installed extensions across a long list of browsers—Chrome, Chrome Beta, Chrome Dev, Chromium, Edge, Brave, Opera, Opera GX, Vivaldi, and Firefox—reporting their IDs. It then matches those IDs against known wallet extensions like MetaMask to flag high‑value targets.
The final step in the Windows chain is a placeholder for a next‑stage payload. JUMPSEC says the exact nature of that payload remains unknown, which is unsettling because it leaves an open question about what the attackers might drop next.
Microsoft Teams variant adds polish
BlueNoroff didn’t stop at Zoom. The researchers captured a second lure variant that impersonates Microsoft Teams. That version is more polished, supporting emoji reactions, blocking mobile or tablet access, and performing more advanced wallet probes before delivering malware.
Even though the core mechanics are the same—fake meeting page, webcam permission, AI‑generated video—the Teams variant feels like a higher‑quality phishing experience. The extra features could make victims less suspicious, especially if they’re used to Teams’ richer interaction set.
Why wallet reconnaissance matters
Profiling a victim’s cryptocurrency wallets before delivering malware is a strategic move. By identifying users who already have wallet extensions installed, the attackers can prioritize high‑value targets, increasing the potential payoff of each infection.
That focus on wallet reconnaissance is what sets this campaign apart from typical phishing ops. Most campaigns just try to dump credentials; BlueNoroff actually does a quick audit of the victim’s crypto holdings, then decides whether to deliver the payload.
- Victims with wallet extensions like MetaMask are flagged as high‑value.
- Telegram session hijack enables lateral movement across contacts.
- AI‑generated video composites increase plausibility of the fake meeting.
- Both Windows and macOS kill chains are compatible, widening the attack surface.
Historical Context: Evolution of Phishing Kits
Phishing attacks have chased a familiar pattern for years: steal credentials, then move laterally. Early kits often relied on generic login forms and simple malicious links. Over time, attackers layered additional tricks to increase conversion rates.
Zoom and Teams became popular vectors after the pandemic forced remote work. Initial lures mimicked basic login screens and harvested usernames and passwords. Those campaigns were effective but lacked depth; they didn’t gather contextual information about a target’s assets.
The BlueNoroff kit represents a shift toward “context‑aware” phishing. By weaving wallet reconnaissance into the flow, the group adds a decision point that filters out low‑value victims. This mirrors a broader trend where threat actors embed profiling steps before dropping payloads.
Each successful breach feeds the next. The AI‑generated video composites are a direct outcome of that feedback loop. The more victims the kit compromises, the richer the source material becomes, which in turn raises the realism of future lures.
That iterative process is why the kit feels more sophisticated than earlier phishing attempts. It’s not just about stealing a password; it’s about building a profile that informs the next move.
What This Means For You
If you manage a team that uses Zoom or Teams, you need to treat any Calendly link from a known contact with the same caution you’d give a cold‑email attachment. Enforce MFA on Telegram and other messaging apps, and consider disabling webcam permissions for web‑based meetings unless you’re absolutely sure of the source.
Developers should also audit their browser extensions for unnecessary wallet add‑ons. Removing or restricting MetaMask‑type extensions on work machines can cut off the attacker’s ability to flag high‑value victims. And security teams should monitor for the specific PowerShell and VBScript patterns JUMPSEC described—especially the Defender exclusion of the C:\Users folder.
Scenario 1: A startup founder receives a Calendly link from a venture‑capitalist contact. The link lands on a perfect‑looking Zoom page, asks for webcam access, and then silently captures the founder’s Telegram session. The attacker now has a foothold in the founder’s network and can reach out to portfolio companies with the same lure.
Scenario 2: An enterprise security analyst uses Teams for daily stand‑ups. A colleague’s compromised Telegram account sends a Teams meeting invite that contains the malicious page. The analyst clicks, enabling the attacker to probe for MetaMask extensions installed on the analyst’s workstation, flagging the account for a higher‑value follow‑up.
Scenario 3: A blockchain developer works on smart contracts and routinely runs MetaMask in Chrome. A phishing email with a disguised Zoom link lands in the inbox, and the developer, trusting the sender, grants webcam access. The resulting session gives the attacker a view of the developer’s wallet extension, prompting a targeted payload aimed at exfiltrating private keys.
All three cases share a common thread: a trusted channel is abused, and the victim’s crypto tooling is used as a scoring metric. The defense is the same—verify links out‑of‑band, limit extension use, and keep an eye on unusual PowerShell activity.
What’s next? The report notes that the attackers continue to refine the kit, feeding each successful breach with new AI‑generated composites. As they iterate, the line between a genuine meeting and a phishing trap will blur even further.
Key Questions Remaining
- Will AI‑generated personas become indistinguishable from real participants, making visual verification unreliable?
- How can defenders detect the wallet‑reconnaissance phase without disrupting legitimate browser extensions?
- What mitigation strategies can organizations deploy against the Telegram session hijack that fuels self‑propagation?
- Will future iterations of the kit incorporate additional crypto‑related extensions beyond MetaMask, expanding the attacker’s targeting scope?
Answering these questions will shape the next generation of defenses. For now, vigilance at the link level and strict controls on extensions are the most practical steps.
Sources: The Hacker News, original report
