# BlueNoroff Zoom Phishing Kit Targets Crypto Wallets

> BlueNoroff uses a custom phishing kit to profile crypto wallets before delivering malware through impersonated Zoom and Microsoft Teams platforms.

- Published: 2026-07-24T17:39:06.000Z
- Severity: high
- Category: Threat Intel
- Tags: BlueNoroff, Lazarus Group, Cryptocurrency Theft, ClickFix, Phishing
- Author: Runtime Rebel Intel
- Primary source: https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html
- Canonical: https://runtimerebel.com/blog/bluenoroff-zoom-phishing-kit-targets-crypto-wallets

## Key points

- BlueNoroff is using a Zoom-themed phishing kit to profile cryptocurrency wallets before initiating malware delivery against high-value targets.
- Threat actors utilize typosquatted domains impersonating Zoom and Microsoft Teams to deceive victims during active social engineering engagements.
- Organizations must implement strict browser extension controls and monitor for unauthorized access to cryptocurrency wallet browser configurations immediately.

## Threat Landscape Evolution: The BlueNoroff Zoom Phishing Kit

According to [The Hacker News](https://thehackernews.com/2026/07/bluenoroff-zoom-phishing-kit-profiles.html), the North Korean [APT](/glossary#apt) known as [BlueNoroff](https://en.wikipedia.org/wiki/Lazarus_Group) has refined its [TTP](/glossary#ttp) by operationalising a sophisticated [Phishing](/glossary#phishing) kit designed to impersonate videoconferencing software. This campaign, which mirrors the "ClickFix" style of social engineering, leverages typosquatted domains for Zoom and Microsoft Teams to establish a false sense of legitimacy. 

BlueNoroff, a sub-group of the Lazarus Group, has a long history of targeting the financial sector and cryptocurrency exchanges. This latest iteration of their arsenal demonstrates a shift toward more granular reconnaissance. Rather than deploying malware immediately upon a victim's arrival at a malicious landing page, the threat actor now employs a kit that profiles the victim's browser environment, specifically looking for cryptocurrency wallet extensions. This selective targeting ensures that the actor only deploys its secondary-stage malware on systems confirmed to contain high-value assets, thereby reducing the noise generated for [SOC](/glossary#soc) teams and automated [EDR](/glossary#edr) solutions.

## BlueNoroff Cryptocurrency Wallet Profiling Tactics

The technical core of this threat lies in the profiling phase. When a victim is lured to a fake Zoom meeting page—often via compromised industry contacts or direct social engineering—the phishing kit executes a script that checks for the presence of browser-based cryptocurrency wallets such as MetaMask, Coinbase Wallet, or Phantom. 

By understanding **BlueNoroff cryptocurrency wallet profiling tactics**, defenders can see that the actor is prioritizing efficiency. The kit evaluates the victim's "worth" in real-time. If the profiling script detects a relevant wallet, the site prompts the user to download a "necessary update" or a "meeting joiner" executable. This executable serves as the initial downloader for more complex [C2](/glossary#c2) frameworks. This multi-stage approach allows the attackers to maintain a low profile, as the high-risk malware delivery only occurs once the target is validated.

## Typosquatted Zoom Domain Malware Delivery

The infrastructure supporting this campaign relies heavily on **typosquatted Zoom domain malware delivery** mechanisms. The attackers register domains that are visually similar to legitimate conferencing URLs, such as `zoom-us[.]vid` or `teams-meeting[.]pro`. These domains are used to host the phishing kit and the malicious payloads. 

Once the victim interacts with the fake interface, the social engineering flow often involves a simulated technical error. The page may claim that the user's browser is incompatible or that a security certificate is missing, instructing them to run a PowerShell command or download a patched installer. These actions lead to the execution of malware that provides the attackers with persistent access to the system, enabling the exfiltration of private keys and seed phrases from the previously identified wallets.

## How to Detect BlueNoroff Zoom Phishing Kit Activity

Detecting this specific campaign requires a combination of network-level monitoring and host-based analysis. Security professionals should focus on identifying unauthorized browser extension queries and unusual outbound traffic to newly registered domains. Identifying **how to detect BlueNoroff Zoom phishing kit** components involves looking for specific [IoC](/glossary#ioc) patterns, such as scripts that enumerate local storage or browser extension IDs.

### Defensive Recommendations

*   **Domain Monitoring:** Implement DNS filtering to block newly registered domains (NRDs) and known typosquatted patterns associated with communication platforms like Zoom and Teams.
*   **Browser Hardening:** Use administrative policies to restrict the installation of browser extensions to a pre-approved whitelist, preventing the unauthorized addition of malicious tools or the tampering of existing wallets.
*   **Identity Protection:** Enforce strict [Zero Trust](/glossary#zero-trust) principles, requiring multi-factor authentication (MFA) for all internal and external communication attempts, even when they appear to originate from known industry contacts.
*   **Endpoint Visibility:** Ensure that EDR tools are configured to alert on PowerShell execution initiated by browser processes, as this is a common payload delivery method in ClickFix-style attacks.

**Related:** [BlueNoroff Exploits Fake Zoom Meetings to Deploy macOS Malware](/blog/bluenoroff-exploits-fake-zoom-meetings-to-deploy-macos-malware), [North Korean Sapphire Sleet Compromises 140+ Mastra AI npm Packages](/blog/north-korean-sapphire-sleet-compromises-140-mastra-ai-npm-packages)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/bluenoroff-zoom-phishing-kit-targets-crypto-wallets