Fake Zoom Meeting Scams Targeting Crypto Executives

Video transcript

Fake Zoom calls are a proven way to steal crypto keys. A fake update or a remote control request puts attackers on your machine.

In one Huntress case, a Telegram message led to a Calendly invite and a fake Zoom page. Deepfaked leaders said to install an extension. It installed eight malicious programs, including a wallet stealer.

The other path uses a real call. An attacker renamed Zoom asks for remote control of your shared screen.

Researchers have documented fake extensions, SDK updates and Teams clones. On these pages, the fix is the payload.

So never install anything a meeting asks for. Close it, and update from the app itself.

Targets include executives, developers and managers in Web3. The malware takes crypto wallets, password managers, cloud credentials and Telegram data.

Turn off Zoom remote control and lock it. Join from the browser. Verify invites on a channel you choose, and take calls on a device that cannot sign.

Trail of Bits puts it plainly. No legitimate business process should ever require giving someone else control of your computer.

If you clicked, disconnect the device but leave it on. Alert the other signers. From a clean device, move funds and rotate keys, then report it.

Guardian's OpSec Audit shows what one executive's laptop could reach. Read the full guide, or talk to Guardian at guardian.security.

Crypto executives take many calls with people they have never met. Attackers use that.

In April 2025, Trail of Bits said its CEO had been invited to a fake "Bloomberg Crypto" series.

In June 2025, Huntress described a crypto foundation employee on a fake Zoom call with deepfakes of their own leadership. This guide covers both attacks, who gets targeted, and the settings that stop them.

The Attack Flow

The two attacks follow different paths.

Fake meeting links

Huntress's June 2025 report traces one case.

1. An employee at a crypto foundation got a Telegram message asking to meet.
2. The Calendly invite showed Google Meet but redirected to a fake Zoom domain.
3. Weeks later, the call showed deepfakes of the company's senior leaders. The employee's microphone failed.
4. The "leaders" told the employee to download a "Zoom extension": an AppleScript file.
5. It installed eight malicious programs, including a keylogger and a crypto wallet stealer.

Huntress attributes the intrusion "with high confidence" to TA444, a North Korean subgroup also known as BlueNoroff.

Remote control requests

Trail of Bits and SEAL call this actor ELUSIVE COMET. In Trail of Bits' case, two X accounts sent the invitations, and the Calendly pages were not Bloomberg's.

On the call, the attacker asks the target to share their screen, then requests remote control. They rename themselves "Zoom" so the request looks like a system notice.

SEAL notes that Zoom allows the request only when the full screen is shared. So attackers claim they cannot see a single shared window.

If control is granted, attackers "can install malware, exfiltrate data, or conduct cryptocurrency theft," Trail of Bits says. It links the group to "millions in cryptocurrency theft."

Trail of Bits says its CEO recognized the scheme and warned staff.

Fake Update Prompts

On a fake meeting page, the "fix" is the payload. Researchers have documented these versions:

Kaspersky attributes its GhostCall cases to BlueNoroff with medium-high confidence. It says the group began shifting from Zoom clones to Teams in September 2025.

In its cases, the faces on screen were "genuine recordings of this threat's other actual victims rather than deepfakes."

SEAL's tell: a call link on a domain other than Google Meet, Zoom or Teams, then an "error" you are asked to fix.

The rule is simple. Never install anything a meeting asks for: close it, and update from the app itself.

Who Gets Targeted

Kaspersky says BlueNoroff "still targets blockchain developers, C-level executives, and managers within the Web3/blockchain industry."

GhostCall mostly hit executives at tech and venture capital firms, on macOS. ELUSIVE COMET impersonates journalists, podcast hosts and investors, SEAL says.

What the malware takes, per Kaspersky:

• Crypto wallets and browser extension data
• macOS Keychain entries, browser logins and password managers
• Cloud and DevOps credentials
• Telegram and other messenger data

Kaspersky also saw invites sent from real founders' compromised accounts, so a familiar name proves nothing.

Signers are prime targets. See social engineering attacks on multisig signers.

Prevention

Disable remote control

• In the Zoom web portal, turn off Settings > Meeting > In Meeting (Basic) > Remote control.
• Admins can set it for everyone under Admin Center > Settings, and lock it.
• In the same menu, set screen sharing to Host Only.
• On macOS, deny Zoom accessibility access. Reset existing grants with tccutil reset Accessibility us.zoom.xos.
• Push PPPC profiles through MDM, so Zoom cannot get that permission even if someone clicks allow.

These steps come from SEAL's Zoom hardening guide and Zoom's help center. Trail of Bits gives staff one rule: "No legitimate business process should ever require giving someone else control of your computer."

Use managed meeting apps

• Install meeting apps only through MDM, and block other installs.
• Join from the browser at zoom.us/join. SEAL notes the web client has no remote control.
• Remove the Zoom desktop client where you can, as SEAL suggests.
• Use SSO and MFA for meeting accounts.

Trail of Bits prefers browser-based tools such as Google Meet for the same reason.

Verify invites out of band

• Confirm the organizer on a channel you choose, such as a known number or Signal.
• Check the link's domain before joining. Huntress flags endings like .xyz, .site and .click.
• Be wary of urgent invites and sudden switches to another platform.
• For a "journalist," contact the outlet directly.
• Take calls on a device that cannot sign transactions.

Device and account rules are in our crypto OpSec baseline.

If You Clicked

Assume the attacker has the machine and everything signed in on it:

1. Leave the call and disconnect the device from the internet. Leave it on, as the FBI advises.
2. If you sign transactions, stop and alert the other signers on a backup channel.
3. From a clean device, move funds and rotate passwords, keys and tokens.
4. Log out of every session, including Telegram, email and exchanges.
5. Warn your contacts, since your accounts may be used to lure them.
6. Report it to your security team and to the FBI at IC3.gov.

Granted remote control but saw nothing install? Treat it the same way. Control is enough to install malware.

Developers get a different lure: see fake job interviews and malicious coding tests.

How Guardian Helps

Guardian's OpSec Audit maps the keys, signers and multisigs behind your funds, end to end. That shows what one executive's laptop could reach.

It also tests whether your incident runbooks hold up.

Managed Security covers devices, keys and signers among its 118 operational security controls. Every multisig transaction is reviewed by its security operations team before signing.

Frequently Asked Questions

What is a fake Zoom meeting scam?

An attacker posing as an investor, journalist or colleague sets up a call. The meeting page asks you to install an "update" or "extension", which is malware. Huntress and Kaspersky attribute cases to BlueNoroff, which Huntress calls North Korean.

Is joining Zoom from the browser safer?

Against remote control, yes. SEAL says the web client at zoom.us/join lacks remote control and cannot request accessibility permissions. It does not stop a fake meeting page, so check the link's domain before you join.

How do I turn off Zoom remote control?

In the Zoom web portal, go to Settings, Meeting, In Meeting (Basic) and turn off Remote control. On macOS, also deny Zoom accessibility access and deploy MDM profiles so it cannot be granted, as SEAL advises.

What should I do if I installed a fake Zoom update?

Disconnect the device but leave it on. If you sign transactions, stop and alert the other signers. From a clean device, move funds and rotate every password, key and token. Report it to your security team and at IC3.gov.

Sources

• Huntress: Feeling Blue(Noroff), Inside a Sophisticated DPRK Web3 Intrusion (June 18, 2025)
• Trail of Bits: Mitigating ELUSIVE COMET Zoom remote control attacks (April 17, 2025)
• Kaspersky Securelist: Crypto wasted, BlueNoroff's ghost mirage of funding and jobs (October 28, 2025)
• SEAL Frameworks: Zoom Hardening Guide
• SEAL Frameworks: ELUSIVE COMET Attack Response
• SEAL Frameworks: North Korea (DPRK) Attack Response
• Zoom Support: Requesting or giving remote control
• FBI (IC3): North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks (September 3, 2024)
• Guardian: OpSec Audit
• Guardian: Managed Security