North Korean hackers targeted crypto exec with fake Zoom meeting, ClickFix scam

Mandiant exposed a tailored UNC1069 campaign where North Korean operators used Telegram-based social engineering and a fake Zoom/Calendly meeting (including an alleged deepfake) plus a ClickFix troubleshooting ruse to infect a macOS host. The attackers deployed multiple bespoke tools—backdoors WAVESHAPER and HYPERCALL and data miners DEEPBREATH and CHROMEPUSH—to steal credentials, browser data, Telegram content and other sensitive files, likely to support cryptocurrency theft and future impersonation campaigns; the group continues to target financial and crypto-sector entities.