BlueNoroff Hijacks Trusted Telegram Accounts to Deliver ClickFix Malware Through Fake Zoom Calls

BlueNoroff (linked to the Lazarus ecosystem) is conducting a sophisticated campaign that commandeers real Telegram accounts to send fake Zoom/Teams meeting links to cryptocurrency and Web3 professionals; the lures profile browsers for crypto wallets and then deliver cross-platform malware—including PowerShell loaders, VBScript implants (Trojan.NukeSped / SLoad), macOS stealers and Mach-O droppers—to exfiltrate credentials and funds. The report details the attack chain, social-engineering techniques (deepfake video, clipboard-based ClickFix lure), extensive IoCs (SHA256 hashes, domains, IPs, filenames), and advises verifying invites on a second channel and inspecting true domains before executing commands or installers.