Zoom, Deepfakes, and Malware: How North Korea is Turning Tech Meetings into Cyber Nightmares
Beware of Zoom calls with friendly execs—they might just be deepfakes from North Korea’s BlueNoroff group. They lure you into downloading “helpful” malware, targeting your macOS. As macOS gains popularity, so do these sneaky scams. Stay alert, or your crypto might just vanish into the digital abyss!

Hot Take:
Oh, the audacity! North Korean hackers are now shaking things up by turning Zoom calls into a deepfake circus, tricking unsuspecting employees into downloading malware. It’s like a bad episode of “Catfish,” but with a side of high-stakes cryptocurrency theft. Who knew corporate espionage could be so… virtual?
Key Points:
- BlueNoroff, a North Korean hacking group, uses deepfake videos of company executives during fake Zoom calls to trick employees.
- The attackers contact employees via Telegram and invite them to a fake Zoom domain, where deepfake videos convince them to download malware.
- The malicious AppleScript file masquerades as a Zoom extension, but actually downloads a harmful payload targeting macOS devices.
- Huntress researchers found eight distinct malicious binaries, including a cryptocurrency-focused infostealer targeting over 20 wallet platforms.
- BlueNoroff’s tactics reflect a trend of increased macOS-targeted attacks as the operating system gains popularity in enterprises.
Already a member? Log in here