BlueNoroff’s Fake Video Meetings Profile Crypto Wallets Before Malware Delivery

By Isaac • July 26, 2026 10:27 am •

Crypto professionals are being lured into counterfeit video meetings built to look familiar at precisely the moment a trusted contact appears to need them. The BlueNoroff campaign turns that ordinary invitation into a staged technical failure, a malicious command, and an operating-system-specific malware path.

The approach combines hijacked Telegram accounts, fake meeting domains, and convincing imitations of Zoom or Microsoft Teams. The findings describe abuse of brands and relationships through social engineering; they do not indicate that Telegram, Zoom, Microsoft, or their genuine software was breached.

Researchers reached unusually deep into the operation because the people running it exposed JavaScript source maps on active infrastructure. That mistake gave investigators source code from a working phishing kit,