Loading story…
North Korea-aligned threat actor BlueNoroff, also known as APT38, has launched two new campaigns, GhostCall and GhostHire, targeting executives, Web3 developers, and blockchain professionals across multiple countries. The campaigns use sophisticated social engineering tactics, such as fake investor meetings and bogus recruiter tests, to lure victims via platforms like Telegram and LinkedIn. Victims are tricked into downloading malicious files during staged video calls or through fraudulent meeting invitations, leading to the deployment of multi-stage, cross-platform malware on both macOS and Windows systems. The malware, written in languages such as Go, Rust, Nim, and AppleScript, includes payloads like DownTroy, CosmicDoor, Rootroy, and others, each designed for credential theft, keylogging, persistence, and further compromise.
GhostCall primarily targets tech firm and venture capital executives, especially in countries such as Japan, Italy, France, Sweden, Spain, Turkey, India, Hong Kong, and Singapore, by exploiting fake investment meetings to deliver AppleScript-based malware. GhostHire focuses on Web3 developers and the broader blockchain industry, distributing malicious ZIP files that infect Windows machines with additional payloads, including a Rust-based loader. Researchers have observed that BlueNoroff's adoption of generative artificial intelligence has accelerated the development of their cross-platform malware, underscoring an evolution in both technical sophistication and targeting strategy within the ongoing SnatchCrypto operation.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On October 29, 2025, reporting based on Kaspersky Securelist revealed that BlueNoroff had reemerged with two social-engineering campaigns, GhostCall and GhostHire, as part of its long-running SnatchCrypto activity. Researchers said the operations showed increased use of modular, cross-platform malware, dynamic command-and-control switching, multiple programming languages, and tailored targeting of the blockchain sector.
In a parallel campaign dubbed GhostCall, BlueNoroff targeted executives at technology firms and venture capital companies across multiple countries using Telegram, LinkedIn, and fake meeting or investor lures tied to Zoom, Teams, and other platforms. Victims were tricked into downloading malicious updates or SDKs that led to macOS compromise and deployment of payloads including DownTroy, CosmicDoor, and ZoomClutch/TeamsClutch variants.
Kaspersky assessed with medium confidence that the Telegram- and GitHub-based GhostHire workflow began no later than April 2025. The campaign used fake job offers, coding tests, and malicious ZIP archives to target Web3 developers and blockchain professionals with malware aimed at stealing credentials, wallet data, SSH keys, and project information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actor BlueNoroff, a sub-cluster of the Lazarus Group, has launched two sophisticated campaigns—GhostCall and GhostHire—targeting executives in the fintech, venture capital, and Web3 development sectors. According to Kaspersky and corroborated by multiple sources, GhostCall leverages social engineering via platforms like Telegram to lure technology and venture capital executives into fake investment meetings, ultimately tricking them into downloading malicious scripts disguised as Zoom updates. These scripts deploy infection chains on macOS devices, resulting in credential theft and system compromise. GhostHire, meanwhile, targets Web3 developers by inviting them to complete skill assessments through booby-trapped GitHub repositories, which deliver tailored malware payloads based on the victim's operating system. Both campaigns demonstrate BlueNoroff's evolving tactics, including the use of generative AI for malware development and a shift from macOS to Windows platforms. Researchers note that these operations are part of BlueNoroff's broader, years-long SnatchCrypto campaign, which aims to steal cryptocurrency and financial data to fund the North Korean regime. The campaigns employ advanced social engineering, cross-platform malware, and innovative infection vectors, highlighting the group's increasing sophistication and adaptability. The targeting of high-value individuals in the fintech and Web3 sectors underscores the persistent threat posed by North Korean APTs to the global cryptocurrency ecosystem, with significant financial and reputational risks for affected organizations and individuals.
Jun 29, 2026
North Korea-linked **BlueNoroff** has been tied to two coordinated intrusion campaigns, **GhostCall** and **GhostHire**, aimed at blockchain developers, executives, managers, and venture capital contacts in the Web3 ecosystem as part of its broader **SnatchCrypto** activity. Researchers said GhostCall lured victims into fake Zoom or Microsoft Teams meetings arranged through Telegram and phishing domains, then tricked them into executing malicious AppleScript on macOS or clipboard-swapped commands on Windows. GhostHire used recruiter impersonation to deliver poisoned coding assignments through Telegram bots, GitHub repositories, and trojanized Go or TypeScript projects. The operations used overlapping infrastructure and a broad malware toolkit spanning at least seven modular macOS infection chains, with families including `DownTroy`, `ZoomClutch`, `TeamsClutch`, `CosmicDoor`, `RooTroy`, `RealTimeTroy`, `SneakMain`, `SysPhon`, and `SilentSiphon`, alongside a keylogger. The actor expanded beyond earlier standalone malware into modular launchers, loaders, droppers, injectors, and stealers written in AppleScript, Go, Nim, Rust, Swift, Python, and C++, and also extended tooling to Windows and Linux in GhostHire. Investigators also observed the use of AI to refine social engineering and enhance images, while stolen webcam footage from victims was reportedly reused in later fake calls to make the scams more convincing; victims were identified across multiple countries, particularly in the Asia-Pacific region.
Jun 29, 2026
North Korean-linked threat actor **BlueNoroff** has been observed targeting **macOS** users through lures tied to fake cryptocurrency news, extending the group’s financially motivated intrusion activity into Apple environments. The campaign used social engineering themes designed to appeal to crypto-focused victims, indicating continued interest in organizations and individuals involved in digital assets and related financial operations. Researchers reported that the operation also introduced **novel persistence** techniques on Macs, suggesting a more mature toolset for maintaining access after initial compromise. The activity highlights a growing risk to enterprises that rely on macOS endpoints in finance and cryptocurrency-adjacent workflows, where trusted news themes and investment-related content can be used to deliver malware and support long-term unauthorized access.
Jun 29, 2026