The North Korean campaign that steals crypt with false meetings, synthetic faces and Telegram bots

A new report on the campaigns attributed to North Korean actors (the activity known by firms such as BlueNoroff / ClickFix / ClickFake) reveals a remarkable transformation: it is not just a matter of isolated posts or links, but an operational platform that combines social engineering, confidence supplanting and malware delivery in a repetitive victim collection pipe.

The campaign takes advantage of legitimate Telegram accounts, real meetings and false calendars to push the victim to a false meeting; the Calendly link redirects to typosquat domains that look like Zoom / Teams URLs. When the victim grants camera permissions, the video does not go to Zoom but to a panel of the attacker using WebRTC mediasup, and the meeting is controlled with messages that induce an "SDK update" that installs the ClickFix charger.

There are two features that raise it over a classic phishing. First, automation to identify high-value targets by fingerprinting browser extensions (looking for MetaMask-type portfolios) and checking Telegram Web sessions to appropriate accounts. Second, the use of previous material to generate video compositions with synthetic faces - according to research, headshots generated with IA are used on actual movements captured in previous meetings - making the supplanting much more credible for contacts that already know the victim.

The implications are strategic: The attackers monetize personal relationships and trust rather than pure technical vulnerabilities. In the Web3 ecosystem, where private keys and browser sessions are access to real value, compromise individuals with privileges or access often is worth more than breaking infrastructure. In addition, Telegram's accounting technique creates a multiplier effect: a kidnapped account serves to launch new campaigns directed against the victim's network.

The detected kit is in active development (multiple versions detected between the end of May and July 2026) and covers Windows and macOS with different infection chains: in Windows it abuses PowerShell and VBScript to disable and exclude folders from Defend, scan browser profiles and detect portfolio extensions; in macOS it delivers false installers that exfilter data through a Telegram bot with embedded token. This practice of encoding tokens facilitates traceability, but does not prevent damage when the bot is already operational.

What users and security equipment should do now: validate the source of Telegram calendar invitations and messages even when they come from known contacts; distrust requests that ask to run updates from pages that mimic Zoom / Teams; keep web messaging sessions closed when not used and review authorized devices in Telegram; use hardware portfolios for private keys and separate the browser for critical operations from the general browser; impose execution control policies (AppLocker / SMB file, unauthorised scripts lock) and monitor changes in antivirus exclusions or endpoint security services.

For detection and response equipment, it is appropriate to implement the monitoring of atypical indicators: creation of exclusions in Defender, unusual connections to typosquat domains (patterns with subdomains that mimic zoom / teams), outgoing WebRTC traffic to non-corporate infrastructures and use of Telegram bots for exfiltration. It is also critical to deploy phishing-resistant authentication mechanisms (FIDO2 / WebAuthn) and to segment environments that host portfolio extensions or keys stored in the browser.

Platformer operators should strengthen reporting processes and quickly suspend malicious domains and bots, and video conference providers should study signals that allow for the differentiation of legitimate meetings from pages requesting camera permits outside their normal flows. Reports such as JUMPSEC show that technical prevention must be accompanied by identity and relationship controls: security today is both social and technical.

If you are responsible for an organization with exposure to cryptomonedas, investors or founders, consider concrete measures: third-party access audits, awareness-raising sessions focused on attacks by supplanting known contacts, and periodic reviews of public profiles that the opponent can use to build deepfakes. Reporting incidents to the affected platforms and authorities also helps to stop the expansion of malicious infrastructure.

The full research and follow-up of these campaigns can be found in the public resources of the analysts who have documented the activity; for general context and additional technical analysis visit JUMPSEC and the specialized coverage of The Hacker News. These threats evolve rapidly: the combination of session control, strengthening of authentication and rigid separation of critical environments is the most practical defense today.