Exposed: ‘s Deadly and Fake Zoom Malware Attacking Crypto on macOS

Imagine getting a Zoom invite from your boss or a big crypto investor. You join the call, see their face, hear their voice, and they ask you to install a quick “Zoom update” for better video. Minutes later, your crypto wallets are empty. This is not a movie plot. It’s the real attack hitting crypto and Web3 companies right now.

The , linked to North Korean hackers from the Lazarus group, is using smart tricks like and fake Zoom links to steal millions in crypto. This campaign started in late 2025 and targets Mac users in blockchain firms. It’s fast, sneaky, and uses new tech to fool even smart people.

In this post, we break down how it works, who gets hit, and simple steps to stay safe. If you work in crypto, read this now.

Who Are the Hackers?

is a team of North Korean cyber crooks. They are part of the bigger Lazarus group, known for huge hacks like the Ronin Bridge theft. Their goal? Steal money to help North Korea dodge sanctions.

They love hitting banks, crypto exchanges, and new Web3 startups. BlueNoroff makes custom malware for Windows, Mac, and Linux. They mix social tricks with tech to get inside networks fast.

Other names for them: APT38, Sapphire Sleet, or Stardust Chollima. They adapt quick to new tools like AI, making them extra dangerous in 2026.

How the Attack Starts: Fake Meetings and

The hack begins with a spear-phish. Attackers pretend to be crypto bosses or partners. They send messages on Telegram or email with links to fake meeting invites.

These links look like real Calendly, Google Meet, Zoom, or Teams pages. But they go to fake sites the hackers control, like typosquatted domains (close spellings of real ones).

You join the “meeting,” and boom – appear. Fake videos and voices of real execs talk to you. They say things like, “Download this Zoom fix for our call.” It feels real because AI makes it perfect.

• Step 1: Phishing message with bad link.
• Step 2: Fake meeting with deepfake boss.
• Step 3: Push to download malware.

The Malware: Fake Zoom Tool for macOS

Victims download a file called something like zoom_sdk_support.scpt. It’s an AppleScript loader from sites like support[.]us05web-zoom[.]biz.

What does it do?

1. Turns off bash history so you can’t trace commands.
2. Checks if your Mac is Apple Silicon (M1/M2 chips).
3. Installs Rosetta 2 if needed for old code.
4. Downloads more bad files step by step.

Once inside, it sets up persistence with Launch Daemons. These run hidden every time you restart your Mac.

Key steals:

• Passwords and cookies from browsers.
• Private keys from wallets like MetaMask, Phantom, Trust Wallet, OKX, Binance.
• Clipboard hijack: Copies your wallet address? It swaps it with hackers’ address. Called “ClickFix” style.
• Keylogs, screenshots, even webcam video.

C2 (command servers) use over 80 fake domains, HTTPS, WebSockets, and Telegram bots to send data out.

MITRE ATT&CK: The Tech Tricks They Use

Experts map this to these tactics:

• T1566.002: Spearphishing links.
• T1059.002: Run AppleScripts.
• T1547.001: Hide in Launch Daemons.
• T1555: Grab stored passwords.
• T1113: Take screen grabs.
• T1056.001: Log your keys.
• T1041: Send data to hackers.

Who Gets Hit and How Bad Is It?

Over 100 crypto firms in 20+ countries. Top spots: USA, Singapore, UK. 80% are blockchain finance. 45% are CEOs or founders.

Attack is super fast: Contact to hack in under 5 minutes. They stay hidden up to 66 days, stealing slow.

New twist: They take your webcam pic, mix with AI to make better fakes for next victims. Stolen Telegram accounts spread the phishing. It’s a chain reaction.

Clipboard swaps steal crypto direct. No big ransom – just quiet wallet drains.

Why Crypto and Web3 Are Perfect Targets

Crypto means big money in hot wallets. Execs use personal Macs with browser extensions. One click, and millions gone.

Web3 is new, so less security rules. Remote work means more Zoom trust. North Korea loves crypto because it’s hard to track.

Compared to old hacks, this uses AI to beat video checks. It’s next-level social engineering.

How to Fight Back: Simple Protection Steps

Block the Bad Stuff

• Domains: support[.]us05web-zoom[.]biz, metamask[.]awaitingfor[.]site, productnews[.]online, firstfromsep[.]online, safefor[.]xyz, readysafe[.]xyz.
• Check file hashes (get from security sites).

Mac-Specific Checks

• Scan for weird AppleScripts and Launch Daemons.
• No unknown Zoom plugins – only from official app.

People Training

• Verify meetings: Call back on known numbers.
• Spot deepfakes: Bad lip sync, weird blinks, odd backgrounds.
• No urgent downloads.

Tech Defenses

• Watch clipboard changes.
• Lock wallet extensions with hardware keys.
• Use endpoint protection that spots these TTPs.
• Least privilege: Don’t run as admin.
• Strong MFA everywhere.

Response Plan

If hit: Isolate Mac, change all passwords, scan wallets, report to authorities.

Stay Ahead in the Crypto Wars

shows hackers evolve fast. AI deepfakes and fake Zoom malware make old rules useless. Crypto firms must mix tech and training.

Watch for updates – this campaign grows. Protect your Mac, verify calls, and secure wallets. Your next meeting could be the one.

Share this if it helped. Stay safe in Web3.