Bitget App
Trade smarter
Buy cryptoMarketsTradeFuturesEarnSquareMore
Fake Zoom malware scam tied to North Korean hackers targets crypto users

Fake Zoom malware scam tied to North Korean hackers targets crypto users

CoinjournalCoinjournal2025/12/15 11:09
By:Coinjournal
Fake Zoom malware scam tied to North Korean hackers targets crypto users image 0
  • The scam relies on Telegram impersonation and pre recorded video calls to build trust.
  • Malware is delivered as a fake audio or SDK patch during the meeting.
  • Security Alliance says it is tracking multiple such attempts every day.

North Korean cybercriminals are escalating social engineering attacks by exploiting fake Zoom and Teams meetings to deploy malware that drains sensitive data and cryptocurrency wallets.

Cybersecurity firm Security Alliance, also known as SEAL, has warned that it is tracking multiple daily attempts linked to these campaigns.

The activity highlights a shift toward more convincing, real-time deception rather than crude phishing.

The warning follows disclosures by MetaMask security researcher Taylor Monahan, who has been monitoring the pattern closely and flagging the scale of losses already linked to the tactic.

The method relies on familiarity, trust, and workplace habits, making it particularly effective against professionals in crypto and tech who regularly use video conferencing tools.

How the fake Zoom scam works

The attack typically begins on Telegram, where victims receive a message from an account that appears to belong to someone they already know. The attackers specifically target contacts with existing chat history, increasing credibility and lowering suspicion.

Once engagement starts, the victim is guided toward scheduling a meeting through a Calendly link, which leads to what looks like a legitimate Zoom call.

When the meeting opens, the victim sees what appears to be a live video feed of their contact and other team members.

In reality, the footage is pre-recorded, not AI-generated deepfakes.

During the call, the attacker claims there are audio issues and suggests installing a quick fix.

A file is shared in the chat and presented as a patch or software development kit update to restore sound clarity.

That file contains the malware payload. Once installed, it gives the attacker remote access to the victim’s device.

Malware impact on crypto wallets

The malicious software is often a Remote Access Trojan. After installation, it silently extracts sensitive information, including passwords, internal security documentation, and private keys.

In crypto-focused environments, this can result in complete wallet drainage with little immediate indication of compromise.

Monahan has warned on X that more than $300m has already been stolen using variations of this approach, and that the same threat actors continue to exploit fake Zoom and Teams meetings to compromise users.

SEAL has echoed the concern, noting the frequency and consistency of these attempts across the crypto sector.

North Korea’s evolving cyber playbook

North Korean hacking groups have long been linked to financially motivated cybercrime, with proceeds believed to support the regime.

Groups such as Lazarus have previously targeted exchanges and blockchain firms through direct exploits and supply chain attacks.

More recently, these actors have leaned heavily into social engineering.

In recent months, they have infiltrated crypto companies using fake job applications and staged interview processes designed to deliver malware.

Last month, Lazarus was linked to a breach at South Korea’s largest exchange, Upbit, which resulted in losses of roughly $30.6 million .

The fake Zoom tactic reflects a broader strategic pivot toward human-centric attack vectors that bypass technical safeguards.

What experts say users should do

Security experts warn that once a malicious file is executed, speed matters.

In cases of suspected infection during a call, users are advised to immediately disconnect from WiFi and power off the device to interrupt data exfiltration.

The broader warning is to treat unexpected meeting links, software patches, and urgent technical requests with extreme caution, even when they appear to come from known contacts.

0
0

Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.

PoolX: Earn new token airdrops
Lock your assets and earn 10%+ APR
Lock now!

You may also like

The Emergence of CFTC-Regulated Clean Energy Platforms and Their Influence on Institutional Investment Approaches

- CFTC-approved CleanTrade, the first SEF for VPPAs/RECs, transforms clean energy markets by addressing liquidity, transparency, and regulatory challenges. - Its $16B trading volume and Cargill-Mercuria's first transaction demonstrate institutional adoption of standardized, verifiable renewable energy assets. - CleanTrade enables ESG alignment through project-specific carbon tracking, reducing emissions by 15% for investors while complying with IRA-driven $2.2T global investments. - By bridging financial a

Bitget-RWA2025/12/15 16:12
The Emergence of CFTC-Regulated Clean Energy Platforms and Their Influence on Institutional Investment Approaches

Clean Energy Market Fluidity and the Rise of CleanTrade: Strategic Considerations for Investors in a Regulatory Environment

- CleanTrade, a CFTC-approved SEF, addresses fragmented pricing and low liquidity in clean energy markets by standardizing VPPA, PPA, and REC trading. - The platform’s $16B in two-month transactions demonstrates institutional demand for transparent, ESG-aligned tools to hedge energy risks and track carbon impact. - By centralizing renewable derivatives and aligning with regulations like SFDR, CleanTrade lowers barriers for investors and developers, accelerating decarbonization while boosting market efficie

Bitget-RWA2025/12/15 16:12
Clean Energy Market Fluidity and the Rise of CleanTrade: Strategic Considerations for Investors in a Regulatory Environment

The Rise of a Dynamic Clean Energy Marketplace

- Global clean energy investment hit $2.1 trillion in 2024, driven by decarbonization trends and institutional demand. - REsurety's CFTC-approved CleanTrade platform addresses liquidity gaps by standardizing VPPA/REC trading with oil-like transparency. - The platform processed $16 billion in two months, enabling risk mitigation and rapid capital reallocation amid policy shifts. - Advanced analytics and structured workflows transform clean energy assets into tradable instruments, attracting diversified inst

Bitget-RWA2025/12/15 16:12
The Rise of a Dynamic Clean Energy Marketplace

The Rise of a Dynamic Clean Energy Market and What It Means for Institutional Investors

- A liquid clean energy marketplace is emerging, enabling institutional investors to trade renewable assets with traditional market efficiency. - E-fuels and platforms like CleanTrade ($16B in notional value) address hard-to-decarbonize sectors while Enel's blockchain-based systems enhance scalability. - Regulatory reforms (e.g., EPA RFS) and industry M&A activity support market growth, though high costs and fragmented standards remain challenges. - 84% of institutional investors plan to increase clean ene

Bitget-RWA2025/12/15 16:12
The Rise of a Dynamic Clean Energy Market and What It Means for Institutional Investors
© 2025 Bitget