Executive Summary
Arctic Wolf Labs identified a sophisticated, globally distributed campaign by BlueNoroff (a subgroup of the DPRK-linked Lazarus Group) targeting the Web3 and cryptocurrency sectors. The attack utilizes a complex social engineering pipeline starting with Calendly invites that lead to typo-squatted Zoom or Teams domains. These landing pages feature AI-generated deepfake participants and real stolen video footage from previous victims to establish credibility while secretly exfiltrating the victim's own webcam feed.
Technically, the campaign leverages 'ClickFix' attacks to trick users into running malicious PowerShell commands via their clipboard. This initiates a multi-stage, fileless execution chain that includes an in-memory C2 implant, Telegram session theft, and a browser credential stealer capable of bypassing Chrome 127+ app-bound encryption. The speed of the attack is notable, with full system compromise often occurring in under five minutes.
The targeting is highly focused on organizational leadership, with 45% of identified targets being CEOs or Founders. This demonstrates a clear strategic intent to gain access to cryptocurrency assets, private keys, and high-trust identities for further exploitation within the Web3 ecosystem. The campaign remains active with continuous infrastructure registration and evolving exfiltration methods, such as Telegram Bot API integration.