Cybersecurity firm JUMPSEC reports that the North Korea-linked threat actor BlueNoroff is deploying fake Zoom and Microsoft Teams meetings as a social-engineering lure to target cryptocurrency users, exploiting trusted workplace collaboration platforms as an attack entry point.

JUMPSEC, a UK-based security consultancy that publishes threat research through its main site and its JUMPSEC Labs division, attributes the activity to BlueNoroff — a group widely tracked by security researchers as a subgroup within North Korea's broader Lazarus hacking apparatus. The attribution should be understood as JUMPSEC's reporting rather than an independently verified finding at this stage.

Key details of the campaign:

• Actor: JUMPSEC attributes the activity to BlueNoroff, a North Korea-linked threat group.
• Method: Fake Zoom and Microsoft Teams meeting setups serve as the primary lure.
• Target: Cryptocurrency holders and managers are the stated focus.

The core of the alleged campaign relies on impersonation. Attackers stage what appears to be a legitimate meeting invitation or call setup, drawing victims into engaging with malicious infrastructure disguised behind familiar collaboration tools. The approach marks a shift toward real-time social engineering, where attackers interact with victims live during a scheduled call rather than relying solely on passive email-based phishing.

Why Fake Meeting Invites Pose a Serious Threat

The tactic exploits familiarity. Zoom and Teams are standard tools for scheduling and joining business calls, meaning a request to join a meeting rarely raises the suspicion that an unsolicited email attachment might. That inherent trust is what makes the lure effective — a fake meeting invite lands inside a workflow the target already considers routine, reducing the instinct to verify the identity of the other party.

Cryptocurrency users represent a logical target for a group like BlueNoroff. U.S. authorities have previously connected North Korean military hackers to schemes aimed at stealing digital assets, as outlined in a 2021 Department of Justice indictment. A United Nations Panel of Experts has also reported that North Korea has stolen hundreds of millions of dollars in cryptocurrency to fund its sanctioned weapons programs, underscoring the strategic importance of such thefts to the state. For attackers, the financial incentive is direct: gaining wallet access can immediately translate into stolen funds.

Practical warning signs aligned with the tactic JUMPSEC describes include meeting requests from unfamiliar contacts, links routing to lookalike Zoom or Teams pages, and any call pressuring participants to install software, approve a prompt, or connect a wallet before proceeding.

Broader Context

The cryptocurrency sector already attracts significant attention from both malicious actors and regulators. In South Korea, overseas exchange apps were recently pulled from Google Play amid scrutiny of how users access trading platforms — a measure of the enforcement pressure surrounding the industry. Social-engineering campaigns that bypass platforms entirely and target users directly represent a distinct and harder-to-police risk category, as they exploit human interaction rather than technical vulnerabilities.

The defensive guidance is straightforward: treat unexpected meeting invitations as unverified until confirmed through a separate, trusted channel, and never allow a video call to serve as the reason for approving a transaction or surrendering credentials.

JUMPSEC's report adds to a growing body of evidence documenting North Korea-linked groups targeting the cryptocurrency industry. Further details on the campaign, if released, would be published through JUMPSEC's own channels.