BlueNoroff ClickFix Phishing Kit Analysis

BlueNoroff, a financially motivated subgroup of the North Korean Lazarus Group, has operationalized a highly effective 'ClickFix' phishing campaign targeting the cryptocurrency and Web3 sectors. The attack chain leverages compromised trusted contacts on Telegram to distribute fake meeting invites. These lures lead to sophisticated single-page applications (SPAs) that impersonate Zoom or Microsoft Teams, using AI-generated deepfake video and simulated technical errors to deceive victims into executing malicious commands.

The campaign is notable for its 'reconnaissance-first' approach, where the phishing kit profiles the victim's browser for cryptocurrency wallet extensions (e.g., MetaMask) before triggering the final malware payload. This allows operators to selectively target high-value assets. Technical analysis of the infrastructure reveals a reliance on bulletproof hosting via Cloudzy and a self-propagating model where successful compromises are used to hijack Telegram sessions and target subsequent victims.

This activity represents a significant evolution in adversary tradecraft, combining social engineering with real-time browser fingerprinting and synthetic media. Organizations in the financial and crypto sectors must prioritize out-of-band verification for meeting requests and monitor for the specific typosquatted infrastructure used in this campaign.