North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto

Validin uncovered an active UNC1069 (Bluenoroff-linked) campaign that uses fake VC personas and convincing, attacker-controlled meeting sites to socially engineer crypto and Web3 professionals into running OS-specific payloads (Windows PowerShell/VBS RATs; macOS Mach-O/Perl; Linux ELF downloaders). The threat actors record meetings via browser APIs and reuse captured media and deepfakes in follow-on scams; researchers linked deployed malware (Cabbage RAT, NukeSped) to Lazarus, identified C2s/IPs (e.g., 45.61.157.248) and dozens of lookalike domains.