North Korean hackers used AI-powered deepfake video calls to attack encryption professionals.

A North Korean-linked hacking group is continuously upgrading its attack methods targeting crypto industry professionals. Using AI-generated deepfake video calls, they impersonate individuals known or trusted by victims, tricking them into installing malware. Martin Kuchař, co-founder of BTC Prague, revealed that attackers use compromised Telegram accounts to initiate video calls, claiming to "fix Zoom audio issues," to lure victims into installing malware disguised as plugins, thereby gaining complete control of their devices. Security research firm Huntress points out that this attack pattern is highly consistent with its previous actions targeting crypto developers. The malicious scripts can perform multi-stage infections on macOS devices, including implanting backdoors, logging keystrokes, stealing clipboard content, and accessing crypto wallet assets. Researchers have strongly attributed this series of attacks to the North Korean state-sponsored hacking group Lazarus Group (also known as BlueNoroff). The head of information security at blockchain security company SlowMist stated that such attacks exhibit clear reuse characteristics across different operations, targeting specific wallets and crypto professionals. Analysts believe that with the widespread adoption of deepfake and voice cloning technologies, images and videos are no longer reliable evidence of identity authenticity. The encryption industry needs to be more vigilant and strengthen multi-factor authentication and security measures. (decrypt)