BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery

North Korean threat actors, known as BlueNoroff, are using a phishing kit to impersonate videoconferencing platforms, including Zoom, in social engineering campaigns. The kit is part of campaigns that utilize typosquatted domains of popular platforms like Zoom and Microsoft Teams. The goal of these campaigns is to deliver malware to targeted individuals. The threat actors use compromised industry contacts and social engineering tactics to abuse trust and gain access to sensitive information. The phishing kit is also used to profile crypto wallets, suggesting a potential interest in cryptocurrency theft. BlueNoroff's tactics combine these elements to facilitate their malicious activities.