North Korean Hackers Intensify Attacks on Crypto Industry Using AI Deepfake Videos

A hacker group linked to North Korea is escalating its attacks on cryptocurrency industry professionals through AI-generated deepfake video calls. According to Odaily, these hackers impersonate individuals familiar or trusted by the victims to trick them into installing malware. Martin Kuchař, co-founder of BTC Prague, revealed that attackers initiate video calls using compromised Telegram accounts and persuade victims to install malicious software disguised as a plugin under the pretext of fixing Zoom audio issues, thereby gaining full control over the device. Security research firm Huntress noted that this attack method closely resembles previous operations targeting crypto developers. The malicious scripts can execute multi-stage infections on macOS devices, including implanting backdoors, recording keystrokes, stealing clipboard content, and accessing encrypted wallet assets. Researchers have confidently attributed these attacks to the North Korean state-sponsored hacker group Lazarus Group, also known as BlueNoroff. The head of information security at blockchain security company SlowMist stated that these attacks exhibit clear reuse characteristics across different operations, targeting specific wallets and crypto professionals. Analysts suggest that with the proliferation of deepfake and voice cloning technologies, images and videos are becoming unreliable for verifying identity authenticity. The crypto industry must remain vigilant and enhance multi-factor authentication and security measures.