Inside BlueNoroff’s ClickFix Kit Masquerading as Zoom and Teams

Researchers at JUMPSEC have disclosed details of an active phishing platform that, according to their findings, is linked to the North Korean group BlueNoroff. The platform imitates Zoom and Microsoft Teams video conferences via typosquatting domains and uses the ClickFix technique to deliver malicious code. A key feature of the campaign is profiling victims’ cryptocurrency wallets before deploying malware, allowing the attackers to selectively hit only high-value targets in the crypto industry. The campaign affects both Windows and macOS users, and its self-propagating mechanism — via hijacked Telegram sessions — turns every successful attack into a springboard for the next one.

Initial access mechanism: trust as a weapon

According to the researchers, the attack does not start with a mass mailing but with the compromise of trusted contacts in the cryptocurrency community. The attackers hijack legitimate Telegram accounts of people the victim personally knows and, on their behalf, send company executives a Calendly link to schedule a meeting. This link does not lead to the real Zoom service but to a fake domain that visually imitates the video conference interface.

Any user who executes the malicious payload while Telegram Web is open or Telegram Desktop is installed becomes a candidate for Telegram session theft. The stolen session is then used to attack that user’s contacts, forming a self-sustaining chain of compromise.

Anatomy of the fake video conference

The phishing page prompts the victim to enter their name and grant access to the webcam. Once permission is granted, the video stream from the camera is covertly relayed to the operators’ control panel using mediasoup WebRTC technology. The victim is placed in a “waiting room,” where they see a message stating that other participants have not yet joined.

Through the control panel, the operator manages the flow of the “meeting”: they send fake messages about a malfunctioning microphone and trigger a prompt to “update the Zoom SDK,” which launches the ClickFix payload. In parallel, the toolkit fingerprints the victim’s browser, taking inventory of installed cryptocurrency wallet extensions.

Particularly noteworthy is the use of pre-recorded videos overlaid with facial images that, according to the researchers, are created using generative AI tools. These faces are superimposed onto real body movements recorded during previous meetings. As a result, each successful attack supplies source material for the next one — the victim sees a familiar face with plausible facial expressions and gestures.

Attack chains: Windows and macOS

Windows

• The ClickFix command launches a PowerShell loader that downloads and executes a VBScript
• The script disables Microsoft Defender, adds the C:\Users folder to the exclusion list, and forcibly restarts Defender to apply the changes
• The implant checks for Telegram Web files in Google Chrome, Microsoft Edge, Brave, and Mozilla Firefox profiles to identify active Telegram sessions and subsequently hijack them
• It enumerates installed extensions in Chrome, Chrome Beta, Chrome Dev, Chromium, Edge, Brave, Opera, Opera GX, Vivaldi, and Firefox — extension IDs are matched against known wallets, including MetaMask
• The implant can deliver additional next-stage payloads, the nature of which has not yet been determined

macOS

• The ClickFix command launches a shell script that downloads a fake Teams or Zoom installer
• The installer activates a stealer that extracts system metadata and Google Chrome master keys from the iCloud Keychain
• Data exfiltration is carried out via a Telegram channel named “Aurora”
• The framework also supports deployment of additional payloads

According to the report, the Telegram-based exfiltration function hard-codes the bot token and chat ID directly into the stealer’s binary.

Two lure variants and active development

The researchers observed two variants of phishing lures — one for Zoom and one for Microsoft Teams. In their assessment, the Teams variant is more sophisticated: it supports emoji reactions, blocks mobile devices and tablets, and performs extended wallet profiling before any malware is delivered.

Infrastructure analysis revealed five distinct versions of the phishing kit between 31 May and 14 July 2026, indicating active development and iterative refinement of the tooling. The source code also contains an unfinished stub for impersonating Google Meet, which has not yet been implemented.

JUMPSEC’s Head of Threat Research, Sean Moran, explains the choice of Zoom and Teams with three factors: the “SDK update” pretext is only convincing for platforms with heavyweight desktop clients; Zoom and Teams are the de facto standard for cryptocurrency and venture capital negotiations; and a domain pattern such as us.zoom.06webin.us is much easier to abuse via typosquatting than meet.google.com.

Impact assessment

The highest risk is borne by executives and employees of companies in the cryptocurrency, venture capital, and decentralized finance (DeFi) sectors. The self-sustaining nature of the campaign — where compromise of a single account automatically expands the attack surface — creates a snowball effect within professional communities. Compromise of high-ranking individuals’ cryptocurrency wallets can lead to direct financial losses, limited only by the balances of the targeted wallets.

Practical recommendations

• Meeting link verification: before following video conference links, manually check the domain — legitimate Zoom links use the zoom.us domain, not subdomains of third-party domains
• No command execution from chats: never copy and run PowerShell or shell commands received via messengers or video conference web pages
• Telegram session protection: enable two-factor authentication in Telegram, regularly review active sessions, and terminate any you do not recognize
• Restrict webcam access: do not grant camera access permissions to web pages — legitimate Zoom and Teams use desktop applications
• Browser extension monitoring: monitor attempts to enumerate extensions and detect abnormal access to browser profiles on corporate devices
• Review Microsoft Defender exclusions: control the addition of folders to Defender’s exclusion list — adding C:\Users is a clear indicator of compromise
• Out-of-band confirmation: if a trusted contact sends a meeting link via Telegram, confirm the request by phone or through another communication channel

The campaign illustrates a shift in tactics against the crypto industry: instead of exploiting technical infrastructure vulnerabilities, attackers are deliberately compromising the people who control access to digital assets. Organizations in the cryptocurrency sector need to bring communication channels — especially Telegram — and interpersonal trust chains between employees into their security perimeter, and enforce mandatory verification of meeting requests via independent communication channels.