BlueNoroff Hackers Leverage Zoom App to Spread Infostealer Malware in Sophisticated Cyberattacks

The Field Effect Analysis team has uncovered a highly sophisticated cyberattack campaign tied to the North Korea-aligned BlueNoroff advanced persistent threat (APT) group, where actors weaponize the Zoom videoconferencing platform as a vector for delivering infostealer malware.

The campaign, targeting industries linked to cryptocurrency and online gambling, underscores the evolving technical prowess of financially motivated threat actors operating under the broader Lazarus Group umbrella.

Technical Attack Overview

Technical analysis reveals that the operation begins with elaborate social engineering using both trusted contact impersonation achieved through credential compromise and accurate Zoom brand emulation.

Victims receive invites to Zoom meetings with seemingly legitimate contacts, only to be exposed to malicious prompts during the call.

For example, during a May 28, 2025 attack on a Canadian online gambling provider, the threat actor induced the victim to execute an AppleScript task masquerading as an “audio repair tool.”

Although the script appeared benign, it concealed a payload within thousands of blank lines, ultimately downloading and executing secondary malware from the rogue domain zoom-tech[.]us.

The infection chain is multi-stage:

• An initial OSA (Open Scripting Architecture) script downloads a secondary shell script, using unique target identifiers for precision targeting and tracking.
• Victims are manipulated into entering their local system credentials, which are immediately exfiltrated to external attacker infrastructure.
• Subsequent payloads fetch and execute further implants including an infostealer binary enabling deep system compromise.
• Persistence is maintained via LaunchDaemon bootstrap configurations, set with administrator privileges, and camouflaged under legitimate-sounding names (e.g., com.apple.security.update).

The malware employs extensive anti-forensics, such as rapid data exfiltration even before the full payload is installed and prompt deletion of temporary artifacts.

Key data targeted includes macOS Keychain files, browser credentials (notably from Chrome and Brave, favored by cryptocurrency users), cookies, and history.

Moreover, reconnaissance scripts gather detailed endpoint and network context, furthering post-exploitation objectives.

Infrastructure and Attribution

According to the Report, The Command-and-Control (C2) infrastructure shows a pattern of Zoom-impersonating domains and rapid-fire domain registrations, often linked via WHOIS records to a common operator.

Analysis ties these domains to BlueNoroff/APT38, notorious for high-value cryptocurrency and financial sector targeting.

Infrastructure overlaps, such as use of Ukrainian security tool GitHub repositories to mask traffic and numerous lookalike domains, indicate a high degree of operational sophistication.

Defending against this campaign requires layered controls:

• Restrict execution of unauthorized scripts and binaries, leveraging macOS Gatekeeper and System Integrity Protection (SIP).
• Deploy Managed Detection and Response (MDR) and EDR platforms to spotlight suspicious scripting behavior, unauthorized credential access, creation of persistence mechanisms, and abnormal network egress (e.g., suspicious curl or rsync activity).
• Enforce organization-wide policies prohibiting spontaneous technical support prompts and encourage verification of all IT assistance requests.
• Conduct ongoing user training and red-teaming exercises to reinforce vigilance against video-call-based social engineering.

The campaign is a prime example of state-sponsored actors embedding themselves seamlessly within the workflows of legitimate business tools to maximize trust exploitation and dwell time, with the explicit intent of financial data theft and subsequent monetization through cryptocurrency assets.

Indicators of Compromise (IoCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates