BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector

Date (as written): 2026-04-27T11:59:23+00:00
Year: 2026
Country: North America
Actors (as written): BlueNoroff (subgroup of Lazarus Group)
Actor pages: BlueNoroff
Tags (as written): Web3/cryptocurrency company

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

100+ cryptocurrency and Web3 organizations across 20+ countries · 27/04/2026

Researchers at Arctic Wolf Labs uncover BlueNoroff deploying spear-phishing via typosquatted Zoom/Teams links and ClickFix injections against 100+ crypto firms, stealing credentials, browser data, and crypto wallet extensions across 20+ countries. [Date Occurred: 23/01/2026; Date Discovered: 23/01/2026]

https://www.hackmageddon.com/2026/05/08/16-30-april-2026-cyber-attacks-timeline/

https://docs.google.com/spreadsheets/d/e/2PACX-1vTbUD4I3wQ1E1jETF6dbBelX6hJcQlgbij6JChX-YeotprThdKtAQeN9ejPXdVBeiQDhudcNBWK5HlY/pub?gid=1060075184&single=true&output=csv

https://www.infosecurity-magazine.com/news/bluenoroff-dprk-hackers-target/

Arctic Wolf blog

BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector · 2026-04-27T11:59:23+00:00

Arctic Wolf has identified a targeted intrusion against a North American Web3/cryptocurrency company, which we attribute with a high confidence level to BlueNoroff, a financially motivated subgroup of DPRK’s Lazarus Group.

https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/

Suggest a correction on GitHub