[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7UP5Q9whi7Gf_oyM-7idZGEo_ndZAXh_ikyRnYfKMWo":3},{"article":4,"iocs":55,"watch_terms":62,"solutions":63,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"d39e5de8-1013-47b1-a6b0-9a0820be8f33","BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery","bluenoroff-zoom-phishing-kit-profiles-crypto-wallets-before-malware-delivery-33203d","The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. \"BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet","North Korean threat actors, identified as BlueNoroff, are employing a sophisticated phishing kit to impersonate Zoom and Microsoft Teams. This kit profiles victims' cryptocurrency wallets before delivering malware, enabling targeted attacks on high-value individuals. The campaign leverages compromised industry contacts and social engineering via Telegram, using fake meeting invitations to steal credentials and webcam feeds.","North Korean BlueNoroff group uses phishing kit to profile crypto wallets before malware delivery.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fbluenoroff-zoom-phishing-kit-profiles.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjs7TSABeFdGk4U17Tg0v-H9ZK2WmPIZ9AtmxJGCtw24Naxa7eEdlvW-eR8yl9NNCAzrMkOCKqSjsdJmAMhuXOq9rHSCE3tNWvTGBe209fpCqn7wVRpUgQ4FgskJgUIWBRz95f25kb8FwrADVj5Cqo5HALXnothJa4kWk9WCU3MG1wkpW_D17sP8o84utoA\u002Fs1600\u002Fzoom-exploit.jpg","2026-07-24T15:12:35+00:00","2026-07-24T18:00:24.307882+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"BlueNoroff","threat_actor",{"name":21,"type":22},"Zoom","product",{"name":24,"type":22},"Microsoft Teams",{"name":26,"type":22},"Telegram",{"name":28,"type":22},"Calendly",{"name":30,"type":31},"WebRTC","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59],{"type":49,"value":57,"context":58},"ClickFix","Name of the malware campaign\u002Fpayload used by BlueNoroff.",{"type":49,"value":60,"context":61},"ClickFake Interview","Name of a related North Korea-aligned threat cluster.",[21,24,26],{"controls":64,"vendors":148},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":95,"name":96,"problem":97,"products":98},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":124,"name":125,"problem":126,"products":127},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[128,135,142],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":132,"url":133,"description":134},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":124,"product_name":139,"url":140,"description":141},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":143,"product_name":144,"url":146,"description":147},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":164},"bluenoroff-uses-fake-zoom-invites-to-target-crypto-wallets","BlueNoroff Uses Fake Zoom Invites to Target Crypto Wallets","The BlueNoroff threat group, linked to North Korea, is exploiting trust in familiar collaboration tools like Zoom and Microsoft Teams by impersonating them in highly targeted phishing campaigns. Before delivering malware, the kit profiles victims' cryptocurrency wallets, allowing attackers to prioritize high-value targets and maximize financial theft. The campaign weaponizes compromised industry contacts and Telegram-based social engineering, meaning victims receive seemingly legitimate invitations from people they already trust. This matters because the combination of reconnaissance, social engineering, and credential harvesting creates a multi-layered attack that traditional security controls alone cannot stop — human vigilance is the critical last line of defense.",[154,155,156,157,158,159,160,161,162,163],"CIS Control 14 — Security Awareness and Skills Training","CIS Control 6 — Access Control Management","CIS Control 9 — Email and Web Browser Protections","NIST SP 800-53 AT-2 — Literacy Training and Awareness","NIST SP 800-53 IA-2 — Identification and Authentication (MFA)","NIST SP 800-53 SI-3 — Malicious Code Protection","NIST CSF DE.CM-1 — Network Monitoring","MITRE ATT&CK T1566.002 — Phishing: Spearphishing Link","MITRE ATT&CK T1657 — Financial Theft","GDPR Article 32 — Security of Processing (for EU-based targets)",{}]