North Korean Hackers Use Fake Zoom Calls to Attack Crypto Firms
Security researchers report that UNC1069, a group linked to the North Korean state, has been using multiple custom malware strains against cryptocurrency firms. Attackers are deploying social-engineering lures—most notably fake Zoom meeting invites and calls—to trick employees into installing payloads on both Windows and macOS endpoints. The intrusions focus on data exfiltration, with operators likely harvesting credentials and internal documents that could facilitate larger thefts or fraud.
This activity underscores heightened risk for the crypto industry, which remains a lucrative target for state-backed cybercrime. Firms should treat unsolicited meeting requests with caution and reinforce endpoint protections, multifactor authentication, and employee training to reduce exposure. The pattern also signals a continued prioritization by threat actors of financial gain through targeted espionage-style tactics rather than opportunistic malware campaigns.