North Korean Actors Exploit ‘Fake Zoom’ to Steal $300 Million in Cryptocurrency

North Korean Actors Use ‘Fake Zoom’ to Drain Crypto Wallets

North Korean cybercriminals are employing 'fake Zoom' tactics to deliver malware that extracts sensitive information, including passwords and private keys, from unsuspecting victims. Reports indicate that these hackers have already siphoned off over $300 million through this method. Cybersecurity experts are warning users to be vigilant against these types of scams.

Key Takeaways

North Korean hackers are using fake Zoom links to install malware on victims' devices.
The scams begin with messages from familiar contacts on Telegram.
Malware can steal sensitive data and completely empty crypto wallets.
The Lazarus Group is known for high-profile cryptocurrency thefts, including a recent $30.6 million hack.
Users are advised to disconnect from the internet and power off devices if suspicious activity is detected.

Fake Zoom Scheme: How It Works

Cybersecurity firm Security Alliance (SEAL) has reported “multiple daily” attempts by North Korean criminals using these deceptive tactics. Taylor Monahan, a security researcher at MetaMask, first detailed the trap set by these DPRK (Democratic People’s Republic of Korea) threat actors on social media.

“They’ve stolen over $300 million via this method already,” Monahan shared on X. “DPRK threat actors are still affecting too many of you through their fake Zoom and fake Teams meetings.”

The Process of Deception

The scam usually kicks off with a message from a Telegram account that appears authentic, often using the name of someone known to the victim.

“They send messages to individuals with whom they have past conversations,” explained Monahan.

Disguised as the trustworthy contact, the hacker directs the victim to a Zoom link through Calendly. When the meeting begins, the victim sees what appears to be a live video feed of their acquaintance and other team members; however, this is actually a recording, not a deepfake.

During the meeting, the hacker raises concerns about audio issues and shares a “patch” file via the chat. They instruct the victim to restore the sound clarity by updating a software development kit (SDK), but this file contains malware.

Once installed, often masquerading as a Remote Access Trojan (RAT), the malware extracts sensitive information, including internal security procedures and passwords, ultimately draining the victim's crypto wallets.

North Korean Hackers: A Shift in Strategy

Groups like the notorious Lazarus Group have been previously associated with significant cryptocurrency thefts designed to earn millions. Recently, these cybercriminals have utilized intricate job application scams and bogus interview processes to breach crypto companies.

In a notable incident last month, the Lazarus Group executed a cryptocurrency breach that resulted in a loss of about $30.6 million from Upbit, South Korea's largest exchange.

With the rise of ‘fake Zoom’ tactics, cybersecurity experts urge users to immediately disconnect from their Wi-Fi networks and turn off their devices if they suspect any malicious activity.

This warning coincides with a dramatic rise in global crypto thefts, amounting to $2.17 billion in stolen assets by mid-2025.