How BlueNoroff's Zoom Phishing Kit Profiles Crypto Wallets Before Delivering Malware

Michael Miller · 2026-07-24

You've probably heard about phishing attacks targeting crypto investors, but the latest campaign from BlueNoroff takes things to a whole new level. These North Korean threat actors have built a sophisticated phishing kit that doesn't just trick you into clicking a link. It profiles your crypto wallet first, then delivers malware tailored to your holdings. Imagine this: you get an email or a message that looks like it's from Zoom or Microsoft Teams. It asks you to join a meeting or download a file. But behind the scenes, the attackers are scanning your system for wallet addresses, balances, and transaction history. They're not just guessing who might be a high-value target. They're confirming it before they even send the malware. ### How the Phishing Kit Works The kit uses typosquatted domains that look almost identical to legitimate Zoom and Teams URLs. A single character difference, like 'z00m' instead of 'zoom', and you might not notice. Once you land on the fake page, it prompts you to download a 'security update' or 'meeting client'. But that file is actually a loader that profiles your system. Here's the scary part: the kit doesn't just look for crypto wallets. It checks for specific wallet types, like MetaMask, Ledger, or Coinbase. It also checks browser extensions and local files. If it finds something valuable, it sends a signal back to the attackers. Then, and only then, does it deploy the actual malware. ### Why This Matters for Crypto Professionals If you're in the crypto space, you're a target. BlueNoroff isn't casting a wide net. They're using compromised industry contacts and social engineering to get inside your network. Once they're in, they profile your assets. This isn't a random spray-and-pray attack. It's a targeted operation designed to maximize payoff. - **Trust abuse**: They leverage your trust in platforms like Zoom and Teams. - **Social engineering**: They use real names, real companies, and real meeting invites. - **Wallet profiling**: They confirm your crypto holdings before committing resources to an attack. ### What You Can Do to Protect Yourself First, always double-check the URL before clicking. Look for subtle misspellings or extra characters. Second, never download software from an email or message link. Go directly to the official website. Third, use hardware wallets and keep your software wallets on isolated devices. > "BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, and wallet profiling into a single, deadly phishing kit." Finally, stay informed. These attacks are evolving fast. The best defense is awareness. If something feels off, it probably is. Trust your gut, verify everything, and never assume a meeting invite is legitimate just because it looks professional. This is the new reality for crypto professionals. BlueNoroff is just one group, but their methods are being studied and copied by others. Don't be their next victim.