Home / Technology / Sophisticated Scam Hijacks Zoom Calls
Sophisticated Scam Hijacks Zoom Calls
29 Apr
Summary
- Attackers used AI-generated personas for fake video calls.
- Clipboard hijacking replaced valid commands with malware.
- Compromise to system takeover took less than five minutes.
State-sponsored threat actors identified as BlueNoroff, a subgroup of North Korea's Lazarus Group, have executed a highly advanced campaign against cryptocurrency companies in North America.
The attackers meticulously crafted fake Zoom video calls, utilizing AI-generated personas and realistic video simulations to deceive their targets. These fake calls were scheduled far in advance via Calendly to enhance credibility.
A critical element of the attack involved a malicious JavaScript embedded in the fake Zoom website. This script intercepted clipboard events, replacing legitimate commands with malware-deploying code when victims attempted to copy and paste.
This technical chain enabled rapid credential theft, session hijacking, and persistence, culminating in full system compromise. Researchers noted the entire process, from initial click to establishing command and control, was completed in under five minutes.
