Loading story…
Kaspersky documented BluNoroff, a North Korea-aligned threat actor associated with financially motivated operations, using the GhostCall and GhostHire campaigns to target cryptocurrency and Web3 organizations. The campaigns rely on carefully prepared social-engineering interactions intended to establish trust with employees and gain access to corporate systems and digital-asset environments.
GhostCall impersonates legitimate business communications, including video-call workflows, while GhostHire poses as recruitment or job-related engagement. Security teams at cryptocurrency firms should validate unsolicited communications and software-installation requests, restrict execution of unapproved applications, and investigate suspicious recruiting or partnership contacts that precede credential requests, downloads, or remote-access activity.
Track how attackers are adapting to this technology.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actor BlueNoroff, a sub-cluster of the Lazarus Group, has launched two sophisticated campaigns—GhostCall and GhostHire—targeting executives in the fintech, venture capital, and Web3 development sectors. According to Kaspersky and corroborated by multiple sources, GhostCall leverages social engineering via platforms like Telegram to lure technology and venture capital executives into fake investment meetings, ultimately tricking them into downloading malicious scripts disguised as Zoom updates. These scripts deploy infection chains on macOS devices, resulting in credential theft and system compromise. GhostHire, meanwhile, targets Web3 developers by inviting them to complete skill assessments through booby-trapped GitHub repositories, which deliver tailored malware payloads based on the victim's operating system. Both campaigns demonstrate BlueNoroff's evolving tactics, including the use of generative AI for malware development and a shift from macOS to Windows platforms. Researchers note that these operations are part of BlueNoroff's broader, years-long SnatchCrypto campaign, which aims to steal cryptocurrency and financial data to fund the North Korean regime. The campaigns employ advanced social engineering, cross-platform malware, and innovative infection vectors, highlighting the group's increasing sophistication and adaptability. The targeting of high-value individuals in the fintech and Web3 sectors underscores the persistent threat posed by North Korean APTs to the global cryptocurrency ecosystem, with significant financial and reputational risks for affected organizations and individuals.
Jun 29, 2026
North Korea-aligned threat actor BlueNoroff, also known as APT38, has launched two new campaigns, GhostCall and GhostHire, targeting executives, Web3 developers, and blockchain professionals across multiple countries. The campaigns use sophisticated social engineering tactics, such as fake investor meetings and bogus recruiter tests, to lure victims via platforms like Telegram and LinkedIn. Victims are tricked into downloading malicious files during staged video calls or through fraudulent meeting invitations, leading to the deployment of multi-stage, cross-platform malware on both macOS and Windows systems. The malware, written in languages such as Go, Rust, Nim, and AppleScript, includes payloads like DownTroy, CosmicDoor, Rootroy, and others, each designed for credential theft, keylogging, persistence, and further compromise. GhostCall primarily targets tech firm and venture capital executives, especially in countries such as Japan, Italy, France, Sweden, Spain, Turkey, India, Hong Kong, and Singapore, by exploiting fake investment meetings to deliver AppleScript-based malware. GhostHire focuses on Web3 developers and the broader blockchain industry, distributing malicious ZIP files that infect Windows machines with additional payloads, including a Rust-based loader. Researchers have observed that BlueNoroff's adoption of generative artificial intelligence has accelerated the development of their cross-platform malware, underscoring an evolution in both technical sophistication and targeting strategy within the ongoing SnatchCrypto operation.
Jun 29, 2026
North Korea-linked **BlueNoroff** has been tied to two coordinated intrusion campaigns, **GhostCall** and **GhostHire**, aimed at blockchain developers, executives, managers, and venture capital contacts in the Web3 ecosystem as part of its broader **SnatchCrypto** activity. Researchers said GhostCall lured victims into fake Zoom or Microsoft Teams meetings arranged through Telegram and phishing domains, then tricked them into executing malicious AppleScript on macOS or clipboard-swapped commands on Windows. GhostHire used recruiter impersonation to deliver poisoned coding assignments through Telegram bots, GitHub repositories, and trojanized Go or TypeScript projects. The operations used overlapping infrastructure and a broad malware toolkit spanning at least seven modular macOS infection chains, with families including `DownTroy`, `ZoomClutch`, `TeamsClutch`, `CosmicDoor`, `RooTroy`, `RealTimeTroy`, `SneakMain`, `SysPhon`, and `SilentSiphon`, alongside a keylogger. The actor expanded beyond earlier standalone malware into modular launchers, loaders, droppers, injectors, and stealers written in AppleScript, Go, Nim, Rust, Swift, Python, and C++, and also extended tooling to Windows and Linux in GhostHire. Investigators also observed the use of AI to refine social engineering and enhance images, while stolen webcam footage from victims was reportedly reused in later fake calls to make the scams more convincing; victims were identified across multiple countries, particularly in the Asia-Pacific region.
Jun 29, 2026