Loading story…
North Korean threat actor BlueNoroff, a sub-cluster of the Lazarus Group, has launched two sophisticated campaigns—GhostCall and GhostHire—targeting executives in the fintech, venture capital, and Web3 development sectors. According to Kaspersky and corroborated by multiple sources, GhostCall leverages social engineering via platforms like Telegram to lure technology and venture capital executives into fake investment meetings, ultimately tricking them into downloading malicious scripts disguised as Zoom updates. These scripts deploy infection chains on macOS devices, resulting in credential theft and system compromise. GhostHire, meanwhile, targets Web3 developers by inviting them to complete skill assessments through booby-trapped GitHub repositories, which deliver tailored malware payloads based on the victim's operating system. Both campaigns demonstrate BlueNoroff's evolving tactics, including the use of generative AI for malware development and a shift from macOS to Windows platforms.
Researchers note that these operations are part of BlueNoroff's broader, years-long SnatchCrypto campaign, which aims to steal cryptocurrency and financial data to fund the North Korean regime. The campaigns employ advanced social engineering, cross-platform malware, and innovative infection vectors, highlighting the group's increasing sophistication and adaptability. The targeting of high-value individuals in the fintech and Web3 sectors underscores the persistent threat posed by North Korean APTs to the global cryptocurrency ecosystem, with significant financial and reputational risks for affected organizations and individuals.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Kaspersky assessed that BlueNoroff is increasingly using generative AI to speed malware development and improve social-engineering content used in the GhostCall and GhostHire campaigns.
The report detailed that the campaigns now deliver malware across macOS, Windows, and Linux using tools such as DownTroy, CosmicDoor, RealTimeTroy, SilentSiphon, SysPhon, RooTroy, and SUGARLOADER, and that the actor's objectives have expanded beyond crypto theft to broader credential and data collection.
Kaspersky disclosed that BlueNoroff is running two active Web3-focused campaigns, GhostCall and GhostHire, under SnatchCrypto to steal cryptocurrency, credentials, and other sensitive data from executives and developers.
Researchers reported that BlueNoroff recently changed parts of its social-engineering approach, moving from fake Zoom meeting lures to Microsoft Teams-themed lures in the GhostCall campaign.
Kaspersky said the broader SnatchCrypto activity attributed to the Lazarus Group sub-cluster BlueNoroff has been active since at least 2017, forming the long-running basis for later GhostCall and GhostHire campaigns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-aligned threat actor BlueNoroff, also known as APT38, has launched two new campaigns, GhostCall and GhostHire, targeting executives, Web3 developers, and blockchain professionals across multiple countries. The campaigns use sophisticated social engineering tactics, such as fake investor meetings and bogus recruiter tests, to lure victims via platforms like Telegram and LinkedIn. Victims are tricked into downloading malicious files during staged video calls or through fraudulent meeting invitations, leading to the deployment of multi-stage, cross-platform malware on both macOS and Windows systems. The malware, written in languages such as Go, Rust, Nim, and AppleScript, includes payloads like DownTroy, CosmicDoor, Rootroy, and others, each designed for credential theft, keylogging, persistence, and further compromise. GhostCall primarily targets tech firm and venture capital executives, especially in countries such as Japan, Italy, France, Sweden, Spain, Turkey, India, Hong Kong, and Singapore, by exploiting fake investment meetings to deliver AppleScript-based malware. GhostHire focuses on Web3 developers and the broader blockchain industry, distributing malicious ZIP files that infect Windows machines with additional payloads, including a Rust-based loader. Researchers have observed that BlueNoroff's adoption of generative artificial intelligence has accelerated the development of their cross-platform malware, underscoring an evolution in both technical sophistication and targeting strategy within the ongoing SnatchCrypto operation.
Jun 29, 2026
North Korea-linked **BlueNoroff** has been tied to two coordinated intrusion campaigns, **GhostCall** and **GhostHire**, aimed at blockchain developers, executives, managers, and venture capital contacts in the Web3 ecosystem as part of its broader **SnatchCrypto** activity. Researchers said GhostCall lured victims into fake Zoom or Microsoft Teams meetings arranged through Telegram and phishing domains, then tricked them into executing malicious AppleScript on macOS or clipboard-swapped commands on Windows. GhostHire used recruiter impersonation to deliver poisoned coding assignments through Telegram bots, GitHub repositories, and trojanized Go or TypeScript projects. The operations used overlapping infrastructure and a broad malware toolkit spanning at least seven modular macOS infection chains, with families including `DownTroy`, `ZoomClutch`, `TeamsClutch`, `CosmicDoor`, `RooTroy`, `RealTimeTroy`, `SneakMain`, `SysPhon`, and `SilentSiphon`, alongside a keylogger. The actor expanded beyond earlier standalone malware into modular launchers, loaders, droppers, injectors, and stealers written in AppleScript, Go, Nim, Rust, Swift, Python, and C++, and also extended tooling to Windows and Linux in GhostHire. Investigators also observed the use of AI to refine social engineering and enhance images, while stolen webcam footage from victims was reportedly reused in later fake calls to make the scams more convincing; victims were identified across multiple countries, particularly in the Asia-Pacific region.
Jun 29, 2026
North Korean-linked threat actor **BlueNoroff** has been observed targeting **macOS** users through lures tied to fake cryptocurrency news, extending the group’s financially motivated intrusion activity into Apple environments. The campaign used social engineering themes designed to appeal to crypto-focused victims, indicating continued interest in organizations and individuals involved in digital assets and related financial operations. Researchers reported that the operation also introduced **novel persistence** techniques on Macs, suggesting a more mature toolset for maintaining access after initial compromise. The activity highlights a growing risk to enterprises that rely on macOS endpoints in finance and cryptocurrency-adjacent workflows, where trusted news themes and investment-related content can be used to deliver malware and support long-term unauthorized access.
Jun 29, 2026