The Attack Mechanism: "ClickFix" and Social

BlueNoroff, a sophisticated subgroup of the North Korean Lazarus Group, has evolved its tactics to include a "Deepfake Pipeline" that utilizes fake Zoom and Telegram environments to compromise cryptocurrency wallets. As of early 2026, this campaign has targeted over 100 organizations, primarily focusing on CEOs and co-founders within the Web3 and blockchain sectors [Source: https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/].

The Attack Mechanism: "ClickFix" and Social Engineering

The group employs a multi-stage social engineering strategy to bypass traditional security measures:

1. Initial Contact via Telegram: Attackers often use compromised Telegram accounts of legitimate industry contacts to reach out to targets. They pose as venture capital partners or legal recruiters to schedule meetings via Calendly [Source: https://therecord.media/north-korean-hackers-targeted-crypto-exec-clickfix].
2. Fake Meeting Infrastructure: Victims are directed to typo-squatted domains (e.g., uu03webzoom[.]us) that host a convincing HTML replica of a Zoom or Microsoft Teams interface [Source: https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/].
3. The ClickFix Prompt: During the fake meeting, the victim is presented with a technical error (e.g., "Zoom SDK update required"). They are then tricked into copy-pasting a PowerShell command into their terminal to "fix" the issue. This command executes a fileless malware loader [Source: https://infosecurity-magazine.com/news/bluenoroff-dprk-hackers-target/].
4. Deepfake Generation: The fake interface uses mediasoup WebRTC to silently capture the victim's webcam feed. This footage is later combined with AI-generated headshots to create deepfakes used to deceive other targets in subsequent attacks [Source: https://darkreading.com/cyberattacks-data-breaches/bluenoroff-turns-victims-into-new-attack-lures].

Malware Capabilities & Wallet Targeting

The malware suite deployed is specifically engineered to identify and drain high-value cryptocurrency assets:

• Wallet Profiling: A specialized module fingerprints browser extensions for popular wallets like MetaMask to verify the target's value before deploying final-stage drainers.
• Credential Theft: The suite targets browser data (Chrome, Edge, Brave, Firefox) and hijacks Telegram sessions by exfiltrating the tdata folder.
• Exfiltration: Data, including screenshots and credentials, is often exfiltrated via the Telegram Bot API to attacker-controlled bots.

Targeting Statistics (Reported March 2026)

Indicators of Compromise (IOCs)

Security researchers have identified several domains and IP addresses associated with this campaign:

• Phishing Domains: uu03webzoom[.]us, check02id[.]com, thriddata[.]com [Source: https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/]
• C2 Infrastructure: 83[.]136[.]208[.]246 (Port 6783), 83[.]136[.]209[.]22 (Port 8444)

BlueNoroff's shift toward AI-generated lures and "ClickFix" mechanisms represents a significant escalation in North Korean cyber-theft operations, moving away from simple malicious attachments toward interactive, high-trust social engineering. While the core goal remains the theft of cryptocurrency, the use of deepfakes allows the group to maintain a self-sustaining cycle of compromised identities to lure new victims.