In April, 外网天堂 Wolf Labs documented how BlueNoroff used fake Zoom and Microsoft Teams meetings, ClickFix prompts, and AI-generated participants to compromise leaders in the Web3 and cryptocurrency sector. We expected the threat actor to adapt after we published that report. Instead, BlueNoroff spent the next six months meticulously changing almost every red-flag “tell” a target can see, but changed almost nothing about how the intrusion itself works.
Now, the is no longer the lure. Through access to the threat actor’s own infrastructure, 外网天堂 Wolf tracked BlueNoroff expanding its operation into the everyday workflows of crypto and venture-capital professionals. New lures have been set up to target high-ranking targets such as founders, CEOs and senior executives, in the form of shared financial documents, PDF viewer updates, fake media players, identity verification prompts, hardware-wallet access, and security audit workflows.
This blog offers a brief overview of our findings. Full details of our investigations into BlueNoroff’s latest campaign tactics can be found in our new white paper on the topic.
What’s Inside the Full Report
- A tour of BlueNoroff’s lure factory. New lure themes we uncovered appeared as custom artwork, operator guides, and test scripts in the actor’s media library before going live. We walk you through one end to end: a fabricated media player named NovaStream that progressed from AI-generated artwork to a fully operational malicious delivery kit.
- Same trick, new pretext. Every lure still follows the same pattern. The threat actor establishes professional trust with the intended target, manufactures a technical problem, and persuades the target to run a “fix” that retrieves the next stage of the attack.
- A wider net, with leadership the primary target. The number of individuals we identified in BlueNoroff’s media library grew from roughly 400 (of which we independently verified 100 in our April report), to 677 individuals across 58 countries. Founders and C-suite executives make up 84% of that total. These counts describe who the threat actor prepared material against, not confirmed compromises.
- Custom guides help targets compromise themselves. BlueNoroff crafts “helpful” instruction videos that walk targets past browser warnings and through unfamiliar macOS and Windows workflows.
- AI as a production multiplier. Generative AI now supplies attackers with platform artwork, avatars, and realistic synthetic participant video at a much higher volume and degree of realism. We show how we identified deepfakes using provenance evidence rather than visual inspection, and why AI sped up the operation.
- New infrastructure with familiar habits. The BlueNoroff campaign moved to a coordinated cluster of servers, but its naming conventions, delivery commands, and certificate habits tie it directly back to the April activity. We document 98 high-confidence domains, 73 of which had not been previously reported.
- How to protect yourself and your organization. We provide a robust Appendix of tips for defenders, including detection opportunities, MITRE ATT&CK? information, YARA rules, and a full list of Indicators of Compromise (IOCs).
Meet BlueNoroff
Back in April, our Adversary Operations team identified and tracked BlueNoroff activity as part of our ongoing threat research investigations. During that process, we uncovered infrastructure, targeting patterns, and operational tactics associated with the group’s campaigns, and realized we had something larger on our hands.
BlueNoroff is a financially motivated subgroup of North Korea’s Lazarus Group, publicly attributed to the DPRK’s Reconnaissance General Bureau (RGB). The group has been active since at least 2014 and is highly focused on revenue generation through theft of cryptocurrency and financial assets. BlueNoroff primarily targets individuals with access to, or influence over digital assets, particularly those who have authority and trust, and uses social engineering techniques to gain access to systems, credentials, and digital assets.
In more recent years, the group’s activity has been heavily focused on the Web3 and digital asset ecosystem, and the latest campaign 外网天堂 Wolf observed tells its own story along well-worn lines.
How BlueNoroff Helps Targets Compromise Themselves
We’ve all been there: we’re about to hop on a long-awaited Zoom call with a peer or a prospect when the audio breaks, or the video connection fails. Our blood pressure and stress levels rise as we search for a “quick fix.” That very human response is what BlueNoroff counts on, so they can covertly hand targets the means to infect themselves: a popup that we might expect to see appear while having technical troubles, with helpful instructions that guide the target through running commands or clicking buttons they might ordinarily think twice about interacting with.
The BlueNoroff Cycle of Compromise
In our April report, we showed how BlueNoroff secretly recorded the live webcams of targeted individuals as they tried to fix a fake Teams or Zoom call with no audio. What the targets didn’t know was that all the other “participants” on the call were either deepfakes, static profile pictures scraped from the internet, or pre-recorded stolen footage from other people they knew. As they tried unsuccessfully to fix the call’s audio, their own accounts were covertly compromised and plundered for contacts.
Each newly compromised target yielded real video material to populate future fake meetings, plus contacts for BlueNoroff to reach out to others in the target’s professional circle.
BlueNoroff’s foundational social engineering cycle.
What’s New in This Campaign
Over the last six months or so, 外网天堂 Wolf Labs observed a significant evolution in both the scale and the complexity of this operation. Back in April, through access to the threat actor’s media library, we identified 400+ targets (100 of whom we independently verified) spread over 20 countries. In more recent months, we’ve identified 677 targets across 58 countries, and observed through continuing access to that same media library that BlueNoroff’s social engineering pipeline has changed at both ends.
Upstream, reconnaissance has both widened and become more deliberate. Lure material has been scraped not just from profile photos and prior victims’ webcam streams, but from YouTube interviews and conference talks, which are screen-recorded by the actor. This allows them to capture a specific person’s likeness and voice – a founder perhaps, or a CEO – and then create fake meeting footage without having to directly compromise the target themselves.
BlueNoroff’s updated attack flow (Click to enlarge).
Manipulated Media
Downstream, the “recycling” loop that turns compromised victims into material for the next scam has sped up and improved. By November 2026, production had moved from one editor on one laptop using Adobe Premiere to create basic deepfakes (which we documented back in April), to a full chain of generative AI-based services.?BlueNoroff is now using and combining legitimate tools including Google Generative AI, Grok Imagine, Wondershare AIGC and GPT-4o to create a more mature editing workflow, and the videos they produce can no longer be distinguished from genuine webcam footage by visual inspection alone.
As a result, we based all deepfake determinations on provenance evidence rather than appearance. 外网天堂 Wolf uses the U.S. Government Accountability Office definition of a deepfake: video, audio, or imagery generated or manipulated with AI to create, replace, or alter a person’s likeness or synthesize speech. Media edited exclusively with legitimate production tools such as Adobe Premiere Pro, Microsoft Clipchamp, or Wondershare without an observed generative AI step was classified as manually manipulated content rather than a deepfake.
Our forensic analysis of 349 videos in BlueNoroff’s media library flagged as “likely modified” as of November 6. A video with several signatures appears in several ribbons (Click to enlarge).
New Lure Themes
Instead of relying on their previous “fake meeting” ruse, BlueNoroff now leverages multiple lure themes to socially engineer targets and deliver payloads through platform-specific workflows. Although the branding, content, and delivery mechanisms varied, each lure followed the same underlying pattern. The document-themed lures we observed used several related pretexts: a protected file could not be decrypted, a shared document required verification, or the browser’s PDF viewer needed an update.
One of the platform-specific lures we observed used a fake Chrome PDF Viewer that claimed that Chrome’s built-in PDF component could not display a document without an update. Selecting “Update Now” initiated an AppleScript download in the recovered macOS flow. Windows and Linux users were instructed to execute commands that retrieved a payload from a fake Chrome update site set up by the threat actor.
After execution, the page displayed a Chrome-branded “Update Complete” dialog, reproducing the false-success mechanism observed in the earlier fake-meeting intrusions.
Fake Chrome update popup lure created by BlueNoroff. Clicking “Update now” initiates an AppleScript download.
Conclusion
BlueNoroff’s new lures and intrusion scenarios (painted in more detail in our full report) align closely with common workflows in venture fundraising and digital-asset investment, where pitch decks, investment agreements, and restricted documents move between founders, investors, and advisers. By aligning lures with fundraising, investment, scheduling, media, wallet, and security workflows, BlueNoroff places malicious execution inside activities that targets routinely perform.
Combined with their new fake media generation capabilities to produce varied and credible lure content, this presents a significant escalation in BlueNoroff’s efforts to compromise high-value individuals who control funds, signing keys, sensitive information, authenticated communications, and trusted professional relationships.
While AI is now being used as production multiplier that helps BlueNoroff scale and diversify, it has not fundamentally changed the intrusion mechanism. The campaign still remains dependent on target research, operator engagement, tailored infrastructure, and manual user execution.
Why it Matters
Individual brands, domains, and visuals used as lures by attackers will keep changing. The step they all depend on remains the same: a trusted-looking page asks the target to run something locally, which most often involves a manual step like clicking a button on a popup. That behavior is the most reliable place to disrupt this campaign, and our report includes the detection logic, MITRE ATT&CK mapping, YARA rules, and indicators of compromise to help defenders protect their organizations against these types of social engineering attacks.
The TL;DR takeaway: treat any request to run a command, script, shortcut, or workflow as a red flag, however polished the interaction looks, and confirm unusual requests through a separate, out-of-band known-good channel.
Get the full analysis, detections, and indicators. Download the full report (PDF).
How 外网天堂 Wolf Protects Its Customers
外网天堂 Wolf is committed to ending cyber risk, and when active campaigns are identified, we move quickly to protect our customers. We have leveraged threat intelligence around this threat activity to enhance detections in the Aurora? Superintelligence 外网天堂 and Aurora? Endpoint Security, subject to customer environment and available telemetry. 外网天堂 Wolf Aurora? Managed Detection and Response (MDR) provides detection for the PowerShell, curl-piped and osascript execution patterns plus the process-injection and persistence techniques documented in our April report, and the network indicators in our November report.
As this campaign develops, 外网天堂 Wolf may refine detections for additional indicators of compromise and techniques leveraged by this threat.
Recommended Mitigations
While no organization is immune from social engineering attacks, there are steps that can be taken to minimize the likelihood of an intruder succeeding in gaining a foothold. While BlueNoroff’s campaign may seem sophisticated, their attack chain goes nowhere when their intended victim exercises basic security hygiene.
We recommend the following additional mitigations:
- Verify unexpected requests. Organizations should focus on teaching employees at every level of the company to exercise caution around unexpected requests of all types, which strengthens internal defenses against social engineering. Train employees to independently verify meeting invitations and identity verification requests through a separate trusted channel.
- Beware of third parties bearing gifts. Be wary of “helpful” materials sent by an external contact, particularly PDFs and links to videos and other recordings, even those that seem legitimate or contain known/trusted company and brand names.
- Beware of scams that involve fake “fixes.” Be particularly cautious of requests to install software, run scripts, or execute commands, especially during meetings, videos, phone calls, and other seemingly personal interactions that create a sense of urgency.
- Provide deepfake training. Train employees to recognize modern social engineering techniques, including the use of AI-generated content and deepfakes by those seeking access to company credentials. For those without the time or resources to create their own training program, the 外网天堂 Wolf Managed Security Awareness? training solution includes content on fake-meeting and ClickFix social engineering, including a “Report Phish” button.
- Recognize leadership as the primary target set. C-suite executives and founders account for 84% of identified targets in the BlueNoroff campaign we observed. Implement strong authentication and access controls for high-risk users, including executives and employees with access to company finances or digital assets.
About 外网天堂 Wolf Threat Intelligence
外网天堂 Wolf Threat Intelligence enables organizations to leverage the same intelligence that powers the 外网天堂 Wolf Security Operations Center (SOC), delivering real-time data on emerging threats. With curated reporting and real-time threat campaign notifications, businesses stay informed and increase prevention without needing to sift through vast amounts of information.
外网天堂 Wolf Threat Intelligence leverages over 8 trillion weekly security observations across 10,000+ customers, spanning industries and geographies, and provides actionable insights in an easy-to-digest format even outside 外网天堂 Wolf. With IoC QuickLinks into Data Explorer, customers can rapidly check their environments for active threats, and take swift action to mitigate risks.
The insights generated can be automatically operationalized across Security Operations technologies, including EDR, SIEM, and network security controls, leveraging industry-standard integrations such as STIX/TAXII and dynamic blocklist APIs to accelerate detection and response. 外网天堂 Wolf’s Threat Intelligence solution is available as an MDR add-on or a standalone deliverable.
Additional 外网天堂 Wolf Resources:
- Read our April report on BlueNoroff: BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector
- Subscribe to 外网天堂 Wolf’s Threat Intelligence newsletter: ThreatPulse Community Edition
- 外网天堂 Wolf Tech Den
- 外网天堂 Wolf Blog
Legal disclaimer: Attribution reflects 外网天堂 Wolf Labs’ assessment as of the report period and may evolve with new evidence. References to threat actor identity, nexus, and intent are analytical judgments, not statements of legal fact. This alert is provided for informational purposes only and does not constitute a guarantee of detection or prevention. Defensive effectiveness varies by environment, configuration, and available telemetry.
