This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A North Korea-linked threat actor, identified as BlueNoroff, targeted a Web3 employee using a sophisticated phishing campaign. The attackers utilized AI-generated deepfakes of company executives during a fake Zoom meeting to gain the victim's trust. This deception facilitated the installation of a multi-stage malware suite on the victim's macOS device, which included a keylogger and a crypto wallet stealer.
An alleged phishing scheme involving actors linked to North Korea used purported AI-generated deepfake videos of company executives to deceive a Web3 employee during a fake Zoom call. The target was reportedly tricked into installing macOS malware disguised as a "Zoom extension," leading to the deployment of spyware, a keylogger, and a crypto wallet stealer. The attackers reportedly used Telegram and spoofed Zoom domains to orchestrate the breach.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The attackers used AI-generated deepfakes of company executives to impersonate trusted individuals in a targeted Zoom call, aiming to deceive a specific employee into installing malware for financial theft.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was caused by human malicious actors who intentionally deployed AI-generated deepfakes post-deployment to deceive the victim.
North Korea-linked threat actor BlueNoroff utilized sophisticated AI-generated deepfakes of company executives during a live video call to compromise a Web3 employee and install data-stealing malware. This represents a significant evolution in state-sponsored social engineering capabilities, highlighting the growing national security threat of synthetic media in cyber warfare.
The AI system was used as a tool to generate synthetic video and audio of company executives. It performed a specific, well-defined function based on direct inputs without autonomous decision-making or planning.
Limited Risk: The report describes the use of AI-generated content such as deepfakes, which are subject to transparency obligations under the EU AI Act.
The AI system was used to generate realistic video and audio deepfakes of company executives to populate a fake Zoom meeting.
The report provides clear details about the attack vector, the role of AI-generated deepfakes in the Zoom call, and the specific malware components deployed. The role of the AI is clearly defined as a deception tool in a spear-phishing campaign.
None. The incident is a classic spear-phishing attack enhanced by deepfake technology.
While the specific deepfake generation software is unnamed, this does not prevent confident classification of the incident's domain, causal factors, or harms.
Technology
AI-Generated Deepfakes
Attackers used realistic AI deepfakes of executives to deceive the employee.
Malicious AppleScript Bypass
AppleScript bypassed user logs and triggered stealth malware installation.
C2 Infrastructure Mimicry
Command and control traffic was routed through domains mimicking Zoom.
Data Inputs
Executive Likeness Data
Attackers harvested executive video and audio to train deepfake models.
Compromised Credentials
Harvesting of browser credentials and cookies facilitated initial access.
Human Factors
Social Engineering Trust
Employee trusted the visual deepfakes representing company executives.
Credential Disclosure
Employee provided system password when prompted by the fake support tool.
Phishing Susceptibility
Employee accepted Telegram messages and fake Calendly invites.
Process and Methods
Inadequate Verification
Lack of out-of-band verification for executive identities on calls.
Unsecured Software Install
Installing unverified Zoom extensions from untrusted chat channels.
Weak Hiring Assessments
Using fake assessments to trick job-seekers into running code.
AI system involved
An AI system was involved, but the reports do not identify it.
Identified by automated extraction; can differ from the alleged developers above.
