State-backed North Korean group UNC1069 is actively targeting crypto companies with custom malware deployed through social-engineering schemes, including fake Zoom calls, to exfiltrate data from Windows and macOS devices. The campaigns appear designed to enable large-scale financial theft.