Fake videoconferencing troubleshooting spear phishing campaign (AppleScripts)

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

(MSMT/2025/2, report p. 101 (Annex 2)) Annex 2, CryptoCore Example: “an MSMT Participating State reported that DPRK actors associated with CryptoCore a large-scale spear phishing campaign that involved arranging virtual meetings with victims using software that resembled a videoconferencing tool but was configured not to function properly, then directing the victim toward malicious links for troubleshooting. According to an MSMT Participating State, in fall 2024 DPRK actors associated with CryptoCore possessed multiple Apple Scripts that likely represented the first stage of the infection chain”