Sophisticated Phishing Kit Steals Crypto Credentials via Fake Meetings

BlueNoroff, a financially motivated threat cluster linked to the Lazarus Group, has been using a sophisticated 'fake meeting' phishing kit to capture webcams, disable Microsoft Defender, and steal cryptocurrency credentials.

The kit is designed to mimic legitimate Zoom or Microsoft Teams meetings, allowing attackers to combine compromised industry contacts with tailored social engineering and wallet reconnaissance to target high-value cryptocurrency users.

Once a victim accesses the link, typically sent from a hijacked trusted contact, the platform initiates webcam access via WebRTC and streams video directly to attacker-controlled panels. It also performs extensive browser-based cryptocurrency wallet fingerprinting using various techniques.

The attackers' objective is to identify high-value targets before deploying malware, significantly increasing their operational efficiency. The campaign underscores a shift in BlueNoroff operations toward scalable, intelligence-driven targeting that blends technical exploitation with human trust abuse.