DPRK's BlueNoroff fingerprints crypto wallets before pushing malware via hijacked Telegram accounts and fake Zoom calls

JUMPSEC obtained source code after operators exposed JavaScript source maps on live servers, revealing two phishing kits impersonating Zoom and Teams, with a Google Meet variant likely. Hijacked Telegram accounts of trusted contacts spread lure links, stealing Telegram sessions to self-propagate. Fake meetings run wallet fingerprinting via EIP-6963 before delivering a ClickFix PowerShell payload under 600 bytes, which downloads a VBScript implant (~13-16KB) classified as Trojan.NukeSped, attributing the campaign to DPRK's BlueNoroff. Operators use AI-generated deepfake video composites. Infrastructure was still active July 24, 2026.

✨ AI summary of the linked source — not editorial content.

Explore the topic

• Crypto
• Telegram
• DPRK
• wallets