[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f9BeqX-r3JZZYAf5-BASZ1sBFNG_l2VoerlAKnFAmueo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"0697d2a6-b95b-4818-b2d6-2e37b6264e13","bluenoroff-uses-fake-zoom-invites-to-target-crypto-wallets","d39e5de8-1013-47b1-a6b0-9a0820be8f33","BlueNoroff Uses Fake Zoom Invites to Target Crypto Wallets","The BlueNoroff threat group, linked to North Korea, is exploiting trust in familiar collaboration tools like Zoom and Microsoft Teams by impersonating them in highly targeted phishing campaigns. Before delivering malware, the kit profiles victims' cryptocurrency wallets, allowing attackers to prioritize high-value targets and maximize financial theft. The campaign weaponizes compromised industry contacts and Telegram-based social engineering, meaning victims receive seemingly legitimate invitations from people they already trust. This matters because the combination of reconnaissance, social engineering, and credential harvesting creates a multi-layered attack that traditional security controls alone cannot stop — human vigilance is the critical last line of defense.","**Immediate actions:**\n- Train all employees — especially those in finance or crypto roles — to verify meeting invitations through a secondary, out-of-band channel before joining.\n- Enable multi-factor authentication (MFA) on all collaboration platform accounts (Zoom, Teams, Telegram) to reduce credential theft impact.\n\n**Long-term improvements:**\n- Implement endpoint detection and response (EDR) solutions capable of identifying anomalous processes spawned from meeting applications.\n- Establish a formal policy requiring verification of any contact requesting sensitive information or meeting access via social platforms like Telegram.\n- Adopt a Zero Trust access model so that compromised credentials alone cannot grant access to critical systems or crypto wallet infrastructure.\n\n**Detection measures:**\n- Deploy DNS filtering and URL inspection tools to block known phishing domains impersonating collaboration platforms.\n- Monitor for unusual webcam\u002Fmicrophone access or credential prompt behaviors triggered by meeting software using behavioral analytics.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 14 — Security Awareness and Skills Training","CIS Control 6 — Access Control Management","CIS Control 9 — Email and Web Browser Protections","NIST SP 800-53 AT-2 — Literacy Training and Awareness","NIST SP 800-53 IA-2 — Identification and Authentication (MFA)","NIST SP 800-53 SI-3 — Malicious Code Protection","NIST CSF DE.CM-1 — Network Monitoring","MITRE ATT&CK T1566.002 — Phishing: Spearphishing Link","MITRE ATT&CK T1657 — Financial Theft","GDPR Article 32 — Security of Processing (for EU-based targets)",{},"published","2026-07-24T18:20:39.04666+00:00","2026-07-24T18:20:38.709+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fbluenoroff-zoom-phishing-kit-profiles.html","bluenoroff-zoom-phishing-kit-profiles-crypto-wallets-before-malware-delivery-33203d","BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"930bbc16-25e4-42e2-9b08-bcca9eb8f473","2026-07-25","morning","ThreatNoir Weekend Brief — July 25","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-07-25\u002Fthreatnoir-morning-brief-2026-07-25.mp3",[51,55,59],{"slug":52,"name":53,"problem":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":56,"name":57,"problem":58},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":60,"name":61,"problem":62},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]