North Korean hacker group BlueNoroff uses fake Zoom and Teams meetings to scan encrypted wallets and release malware

According to Crypto.news, BlueNoroff, a hacking group linked to North Korea, used fake Zoom and MicrosoftTeams meetings to analyze cryptocurrency users before releasing malware. The hacker first controls the crypto-industry contact account trusted by the victim, and then sends a seemingly normal meeting link through Calmly and others pointing to the fake Zoom/Teams domain name. After the user enters the fake meeting page, the page quietly scans the wallet in the browser and decides whether to continue the attack based on the value of the wallet. A fake meeting will ask to "update Zoom/Teams" or run a command to actually download malware (Windows and macOS support). Malware steals browser keys, system data and Telegram sessions.