North Korean dangerous actors are behind this Clickfix-style campaigns Those using typosquatted Zoom and Microsoft Teams domains have been found to be operating an active phishing kit to impersonate videoconferencing platforms in social engineering campaigns designed to distribute malware.
“Bluenoroff “The abuse of trust was conducted by combining compromised industry contacts, social engineering, wallet reconnaissance and malware delivery into a repetitive victim acquisition pipeline,” JUMPSEC said in a detailed report shared with The Hacker News. “The platform profiles victims’ cryptocurrency wallets prior to malware delivery, enabling selective targeting of high-value victims.”
Describing the campaign as an operator-driven victim acquisition platform, the cybersecurity company noted that the activity involved using compromised trusted contacts as an initial access vector to create a self-promoting attack chain via Telegram.
Details of the activity have been documented in detail since early 2025, with Sequoia tracking a second threat cluster linked to North Korea under the Clickfake Interview alias due to the use of clickfix-like lures to trick unwitting targets into running malicious commands under the pretense of addressing camera or audio issues.
According to JUMPSEC, lure links are delivered from an account the target already trusts and has met in real life. Attackers have hijacked legitimate Telegram accounts of individuals in the cryptocurrency sector to send messages to high-ranking employees of major companies and share calendrical meeting links.
JUMPSEC described the self-sustaining nature of the campaign, saying, “Every victim who runs the payload by installing Telegram Web Open or Telegram Desktop is a candidate to have their Telegram session stolen and reused against their own contacts.”
The Calendly link leads the victim to a Zoom meeting URL, but in reality, it is a fake domain impersonating the videoconferencing service. Users who land on a phishing page are asked to enter their name and allow access to the webcam. However, once permissions are granted, the webcam stream is silently sent to the operators’ panel via MediaSoup WebRTC.
|
| multifunctional operator panel |
In the final step, after the victim joins the meeting, they are shown another page where they appear alone in the Zoom call, along with the message “Waiting for other participants.” This sets the stage for the next phase of the attack.
“Once the victim joins, the operator can continue to use their panel to control the meeting, send a fake ‘Your mic is not working’ message, and trigger a ‘Zoom SDK update’, ultimately resulting in the ClickFix payload,” JUMPSEC said.
Additionally, the kit performs a fingerprinting step to list the cryptocurrency wallets installed on the web browser, after which the “admin” joins the fake meeting. The twist here is that the video the victim watches is not a live stream, but a pre-edited video that consists of AI-generated headshots created using OpenAI ChatGPT and superimposed over authentic body movements captured during previous meetings.
“Therefore, each successful attack feeds the source material into the composite used against the next target,” JUMPSEC explained. “That combined with the Telegram account takeover method means the fake meeting shows a familiar-looking face, matching the body language of someone who was actually captured on camera.”
The cybersecurity company said it has captured two different lure variants for Zoom and Microsoft Teams. The Team version is considered more sophisticated than the Zoom version, supporting emoji reactions, mobile/tablet blocking, and advanced wallet checking before malware delivery.
ClickFix attack chains are compatible with both Windows and macOS. A brief description of each of them is as follows –
-
Windows Kill Chain:
- The ClickFix command runs a PowerShell loader that downloads and executes the VBScript, disables Microsoft Defender, adds the “C:\Users” folder to the exclusion path, and force restarts Defender so the exclusions take effect.
- The VBScript implant checks for the presence of Telegram web-related files within Google Chrome, Microsoft Edge, Brave, and Mozilla Firefox profile directories to determine whether the victim has an active Telegram account and potentially hijacks the account’s session cookies in order to use it to take control of the account and target other persons of interest.
- The implant enumerates installed extensions in Chrome, Chrome Beta, Chrome Dev, Chromium, Edge, Brave, Opera, Opera GX, Vivaldi, and Firefox, reporting their corresponding extension IDs, which are then matched with known wallet extensions like MetaMask to identify high-value targets.
- The implant also supports the capability to deliver next stage payloads, although their exact nature remains unknown.
-
macOS kill chain:
- The ClickFix command runs a shell script, which then downloads a fake Teams (or Zoom) installer.
- The installer runs the main stealth payload to extract sensitive data from iCloud Keychain, including system metadata and Google Chrome master keys, to the attacker via a Telegram channel called “Aurora” and deploys additional payloads.
Further research revealed that the Telegram exfiltration function hard-codes bot tokens and chat IDs within the stealer binary. The bot querying the Telegram API for the token linked it to an operator who goes by the name “John” (@alchemy_john_mac). As recently as May 2026, the individual was seen asking administrators of the MAIV cryptocurrency group about vesting contracts and withdrawing their funds.
Additionally, investigation into the threat infrastructure discovered five different versions of the phishing kit from May 31 to July 14, 2026, indicating active development and fine-tuning efforts.
A notable aspect of the campaign is its specific focus on Zoom and Teams-related engagement, as opposed to Google Meet. Sean Moran, head of threat research and enablement at JUMPSEC, told The Hacker News that there are three possible reasons behind this behavior: clickfix pretext, target-application fit, and typosquatting surface –
“The whole ‘Zoom/Teams SDK is out of date’ thing – that only comes up on platforms that the victims believe have a somewhat heavyweight desktop client (like Teams and Zoom have). But Google Meet has no desktop application and is browser-first, so it doesn’t really make sense.
Zoom and Teams are the default for a lot of crypto/venture capitalists/founders in the finance world – while Google Meet feels more like a client calling platform rather than an “investor/partnership call”.
The whole domain scheme is ‘us.zoom.06webin.us’ and that makes it really easy for someone to fall for their fake links as they are identical to the real Zoom link with all the sub-domains, whereas ‘meet.google.com’ is harder to type/spoof.”
Moran also noted that while the phishing kit currently only ships Zoom and Teams lure pages, an unimplemented stub of a Google Meet equivalent exists in the source code. That said, this is probably a deliberate choice due to the above mentioned factors and the fact that the current set up is actively working.
JUMPSEC concluded, “The implications go beyond this specific campaign. As Web3 and digital assets continue to mature, threat actors are increasingly recognizing that compromising the individuals controlling access can be just as valuable as attacking the underlying infrastructure.”
“Blunoroff’s continued refinements demonstrate that organizations must consider identity, relationships, and communication channels as critical parts of their security posture.”
