BlueNoroff Hijacks Trusted Telegram Accounts to Deliver ClickFix Malware Through Fake Zoom Calls

A North Korean hacking unit has refined a scheme that turns everyday chats into malware traps. The BlueNoroff group, linked to the wider Lazarus ecosystem, is taking over real Telegram accounts that belong to trusted industry contacts.

Those stolen identities then send fake Zoom and Microsoft Teams meeting links to senior staff at cryptocurrency and Web3 firms.

The motive is financial. Operators scan browsers for crypto wallets before they deliver malware, then aim to steal credentials and funds that can support state-backed goals.

The effort works less like a simple fake page and more like a repeatable pipeline that grows each time a new contact is compromised.

Analysts from Jumpsec identified the operation after operators left JavaScript source maps exposed on live servers. 

Jumpsec said in a report shared with Cyber Security News (CSN) that the kit impersonates Zoom and Teams meetings while quietly profiling wallets and guiding victims into a ClickFix paste step.

The team rebuilt both Windows and macOS paths from the first lure through later theft stages. Trust is the real weapon. Victims hear from people they already know and may have met in person.

Advice to check the sender falls short because the account is genuine; only the person controlling it has changed. Patterns like this also appeared in a related new BlueNoroff campaign that used fake meeting pages against crypto professionals.

The harm spreads outward. Any infected machine with Telegram open can lose its session, feeding a loop that keeps bringing in fresh targets.

Firms that hold large digital assets remain prime prey because one successful breach can unlock serious value.

BlueNoroff Hijacks Trusted Telegram Accounts

In cases Jumpsec reviewed, hijacked Telegram accounts of real contacts messaged high-ranking employees at major companies.

A founder warning that their Telegram account was compromised. This capture victims chatting with those accounts without sensing the switch.

The invite looks ordinary at first glance. Links place familiar labels such as us.zoom on attacker-owned domains so the address feels safe.

After the user types a name and allows the camera, the page silently sends the webcam feed to an operator panel.

The victim then sits in a fake waiting room while the operator joins with a staged video built from AI headshots and real body motion.

Timed chat lines claim the microphone is failing and push a fake Zoom SDK update. That prompt opens the ClickFix box.

When the victim copies what seems like a simple fix, the clipboard is replaced with a harmful command, shown in Figure 12. The same social trick builds on the wider ClickFix lure technique seen in other malware drives.

Before any payload lands, the kit checks the browser for wallet tools such as MetaMask and related objects. Results flow to the operator panel so only high-value targets receive the full chain.

Zoom and Teams builds share the same core module, and a Google Meet string in the code hints that a third lure may exist. Readers who follow Lazarus Group crypto campaigns will recognize the long focus on DeFi trust and chat-based delivery.

Attack Chains and How to Stay Safe

On Windows, the pasted command runs a small PowerShell loader that fetches a VBScript implant classed as Trojan.NukeSped, a family tied to Lazarus tooling.

The script collects system data, browser extensions, and signs of Telegram use, then calls home for more payloads while trying to weaken local defenses.

On macOS, shell scripts pull fake Zoom or Teams installer apps that keep the user busy while a stealer reads Chrome keychain secrets and ships them out through Telegram bots.

Researchers found several Mach-O binaries and noted that some stealer builds had little obfuscation, which helped analysis. Supporting hosts clustered on one provider with many Zoom and Teams lookalike domains still live during the review.

For teams that already faced a fake Zoom meeting style trap, the warning is familiar: a brand name inside a link is not proof the site is real.

If you work in Web3 and receive a Zoom, Teams, or Meet invite over Telegram, even from someone you have known for months, confirm the plan on a second channel before you click.

Study the true domain, not only the subdomain labels. Real meeting tools never ask you to paste terminal commands to repair audio or camera problems. Treat trusted chat channels as part of your security edge, because BlueNoroff is counting on that trust to open the door.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.