BlueNoroff Deploys Fileless PowerShell in AI-Generated Zoom Lure Campaign

A sophisticated BlueNoroff campaign targeting cryptocurrency executives through fake Zoom meetings enhanced with AI-generated deepfakes and fileless PowerShell malware.

The North Korean state-sponsored group successfully compromised a North American Web3 company in January 2026, maintaining persistent access for 66 days through entirely memory-resident attacks.

The campaign begins with social engineering through Calendly invitations that contain typo-squatted Zoom domains resembling legitimate meeting links.

When victims click these links, they enter fake video conferences populated with AI-generated participants created using ChatGPT’s GPT-4o model and repurposed webcam footage from previous victims.

BlueNoroff, also known as APT38 and part of North Korea’s Lazarus Group, carries out these financially motivated attacks on behalf of the RGB intelligence agency.

The fake meetings display realistic participant tiles showing either stolen video of real people, AI-generated portrait images, or deepfake composite videos combining synthetic faces with authentic body movements.

Arctic Wolf has identified a targeted intrusion against a North American Web3/cryptocurrency company, which we attribute with a high confidence level to BlueNoroff.

A message sent by the threat actor from their compromised Telegram account, reaching out to a new target with a Calendly link to initiate a “catch-up” meeting.

Analysis of the attacker’s infrastructure revealed over 950 media files used in this deepfake production pipeline, with victims’ exfiltrated webcam footage reprocessed through Adobe Premiere Pro to create future lure content.

Fileless PowerShell Execution Chain

After victims join the fraudulent meeting, they receive a prompt claiming their Zoom SDK requires updating.

When mapped to Korean Standard Time (UTC+9), operator activity is concentrated during standard business hours (approximately 08:00–18:00 KST), Monday through Friday, with minimal activity on weekends.

This ClickFix attack tricks targets into copying terminal commands that inject malicious PowerShell code directly into memory.

Fileless malware techniques like these have become increasingly prevalent, with 77% of successful attacks now using fileless exploits to bypass traditional antivirus software.

The false Zoom or Teams window announces that the victim’s “SDK is deprecated” and presents them with an “Update Now” button.

The attack progresses through multiple stages within five minutes: PowerShell downloaders obfuscated with Base64 and XOR encryption establish C2 beacons, browser credential stealers inject into Chrome and Edge processes using AES-encrypted shellcode, and Telegram session hijacking enables the attackers to impersonate victims in future campaigns.

All execution occurs in-memory without writing files to disk, evading signature-based detection.

Targeting and Attribution

Arctic Wolf identified 100 victims across 20+ countries, with 41% in the United States and 80% working in cryptocurrency or blockchain sectors.

The AES key via COM decryption, discovers profiles, queries each profile’s Login Data database, decrypts credentials, writes CSV output, then extracts the browser fingerprint.

CEOs and founders comprised 45% of targets, reflecting BlueNoroff’s focus on individuals with direct access to cryptocurrency wallets and private keys.

The Lazarus Group subgroup has specialized in financial cybercrime since at least 2014, including the 2016 Bangladesh Bank heist that netted $81 million.

Analysis of metadata from the deepfake production environment revealed an operator using the macOS username “king” working during DPRK business hours, with activity concentrated between 08:00-18:00 Korean Standard Time on weekdays.

Infrastructure analysis uncovered over 80 typo-squatted Zoom and Teams domains hosted on Petrosky Cloud LLC (AS400897), matching previously documented BlueNoroff fake conference campaigns.

The combination of AI-powered social engineering with fileless execution represents an evolution in state-sponsored cryptocurrency theft operations.

Organizations should implement PowerShell Script Block Logging, restrict getUserMedia API access, and train employees to verify meeting requests through secondary channels.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.