North Korea-Linked UNC1069 Hacks Crypto Pros via Fake Meetings

UNC1069, a North Korea-linked threat actor, is conducting highly targeted campaigns against cryptocurrency and Web3 professionals by hijacking accounts and luring victims into fake Zoom/Google Meet/Microsoft Teams sessions that coerce users to paste terminal/PowerShell commands. The campaign uses multi-stage, cross-platform malware (Windows VBS/Cabbage RAT variants, macOS Mach-O downloaders leading to NukeSped RAT, and ELF RATs on Linux), browser-based covert surveillance on fake meeting pages, and supply-chain techniques (e.g., compromised npm packages) to achieve long-term access and asset theft; defenders are advised to verify counterparties out-of-band, block risky scripting behaviors, monitor related infrastructure, and enforce least-privilege controls.