North Korea-Linked UNC1069 Uses Fake Zoom and Teams Meetings to Hack Crypto Professionals

**Executive Summary:** UNC1069 is running a sophisticated, financially motivated campaign that lures crypto and Web3 professionals into counterfeit video meetings (via LinkedIn/Telegram/Calendly) to execute platform-tailored payloads—updated variants of Cabbage RAT/CageyChameleon—that enable browser extension and system data theft, persistent access (startup shortcuts, Defender exclusions), and real-time audio/video capture streamed via WebRTC/WebSocket for reuse in follow-on social engineering; the report links the campaign to an Axios NPM compromise and shows cross-platform impact and advanced social-engineering TTPs.