Inside BlueNoroff’s “Self-Reinforcing” Deepfake Meeting Trap

Arctic Wolf reveals a global BlueNoroff (Lazarus subgroup) campaign that lures cryptocurrency and Web3 executives into typo‑squatted fake Zoom/Teams meetings rendered by JavaScript, where deepfake participants (stolen webcam footage, AI stills, and composite videos) are used to prompt victims to run a fake “update” troubleshooting flow that deploys a PowerShell-based C2 implant; targeting patterns and activity hours align with DPRK state-sponsored operations.