North Korean Hackers Target Crypto Firms with ClickFix and AI-Made Zoom Lures

Arctic Wolf Labs attributes a sophisticated, BlueNoroff-linked spear-phishing campaign to Lazarus operatives who targeted more than 100 crypto and related firms across 20+ countries using typosquatted Zoom/Teams links, fake Calendly invites, clipboard/browser injection aimed at wallet extensions, a deepfake pipeline from exfiltrated webcam feeds, PowerShell C2 implants, AES-encrypted payloads and Telegram-based exfiltration; the campaign enabled rapid full-system compromise and prolonged access for credential and asset theft.