North Korean hackers are using fake Zoom and Teams calls to install malware that drains crypto wallets via social engineering. Security researchers say the tactic has already stolen over $300M from victims.

"The hacker, disguised as the “known person,” then guides the victim to a Zoom link via Calendly. Once the meeting starts, the victim sees a live video feed of their contact and other team members, which is a recorded video in reality, rather than deepfakes. The hacker then complains about the lack of audio clarity, sending a “patch” file via chat and asking the victim to restore the clarity by updating a software development kit, or SDK. The file shared contains the malware payload. The malware, often a Remote Access Trojan (RAT), if installed, will exfiltrate sensitive data, including internal security protocols, passwords, and drain crypto wallets completely."

Top comment by @Spencer420

More coverage

• ️ north korean hackers use 'fake zoom' calls to steal $300m in crypto (binance.com)
• North Korean Hackers Target Crypto Firms with Fake Zoom Invites (zendata.security)
• North Korean Hackers Target Crypto Firms with ClickFix and Zoom ... (infosecurity-magazine.com)
• This Week in Cybersecurity: AI Tool Breach & North Korea's Fake ... (blog.openvpn.net)
• North Koreans are hacking Mac users with fake Zoom interview invites (moonlock.com)

Explore the topic

• North Korea
• Social Engineering
• Hacker
• Security