North Korean hackers target crypto executives using fake video meeting links
North Korea's Lazarus Group is targeting cryptocurrency and fintech executives through fake video meeting invitations that trick users into running malicious terminal commands.
FTMQ Security, written by our newsroom0 views
North Korea's Lazarus Group is executing a new cyberattack campaign against executives at cryptocurrency and financial technology companies, CoinMarketCap reported. Cybersecurity researchers at CertiK uncovered the operation on Wednesday and designated it Mach-O Man. [1]
The campaign relies on an entry vector known as ClickFix to breach corporate networks, according to CoinMarketCap. Attackers contact targeted executives over the Telegram messaging application with urgent invitations to video meetings. [1]
When victims click the provided link, they are directed to a fraudulent website disguised as Zoom, Microsoft Teams, or Google Meet, CoinMarketCap reported. The malicious page prompts the user to copy and paste a command into their system terminal under the guise of fixing a fake audio or video connection issue. [1]
Executing the terminal command grants the attackers direct access to the target's corporate systems, software-as-a-service platforms, and financial accounts, CoinMarketCap reported. Cryptocurrencies rely on distributed ledger technology to secure digital asset transactions. [1][4]
In short
- Security researchers at CertiK disclosed the Mach-O Man cyberattack campaign.
- Attackers send fake meeting links disguised as Zoom, Teams, or Google Meet via Telegram.
- The ClickFix social engineering technique tricks users into running terminal commands to fix fake connection errors.
- Executing the command gives attackers access to corporate systems, SaaS platforms, and financial accounts.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Lazarus Group Uses Fake Meetings to Hijack Crypto FirmsCoinMarketCap, 15h ago (the report this story comes from)
- [2]The Internet Is Breaking Down, Says Japan's GMO Internet Group CEO After Hackers Hijack Its Cloud Servers To Run Unauthorized FX TradesOfficeChai, 7h ago
Background
- [3]Lazarus (Japanese TV series) on Wikipedia
- [4]Cryptocurrency on Wikipedia
Our newsroom writes these reports with the help of software, from the 4 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Malicious AGENTS md files trick AI coding tools into executing rogue commandsTop Stories, 1h ago
- US authorities target North Korean laptop farms and remote IT worker schemeThreat Intelligence, 11d ago
- Compromised CDU Heilbronn email account used in phishing attack on officialsThreat Intelligence, 7d ago
- P7 DarkSword iOS exploit kit steals crypto wallet data and commands devicesTop Stories, 14d ago
- US Law Enforcement Disrupts North Korean Remote IT Worker Laptop FarmsNation State Hacking, 7d ago
More in Threat Intelligence
- CISA adds Collabora Online command injection vulnerability to KEV catalog2d ago
- Attackers Target OAuth Tokens to Bypass MFA and Password Resets3d ago
- PHP issues emergency patches for critical zero day flaws dubbed php2shell4d ago
- Compromised eMudhra intermediate certificates revoked after weak private key discovery4d ago
- State Bank of India investigates dark web leak of customer data4d ago
- Hitachi Energy RTU500 series faces denial of service vulnerability5d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.