North Korean Hackers Use Deepfake Video Calls to Target Crypto Firms

Google Cloud Mandiant attributes a campaign to UNC1069 (North Korea-linked) targeting fintech and cryptocurrency firms using hijacked Telegram profiles, social-engineered calendar invites to fake video calls (with reported deepfakes), and ClickFix-style ruses to trick macOS victims into executing commands. Attackers installed multiple backdoors (Waveshaper, Hypercall), information stealers and a data miner (Deepbreath, CHROMEPUSH) to exfiltrate Keychain credentials, browser data, Telegram and Notes data to facilitate cryptocurrency theft and future social engineering.