February 11 News, Google’s security team Mandiant disclosed that a North Korea-linked hacker group is using deepfake videos and fake Zoom calls to carry out highly targeted social engineering attacks against the cryptocurrency industry, and is deploying multiple malicious programs to steal assets and data.
The investigation shows that this operation was launched by the cyber threat group UNC1069. The group has been active since at least 2018 and shifted its focus from traditional finance to the Web3 space after 2023, targeting executives of crypto financial technology companies, software developers, and venture capital professionals. The incident began when an industry executive’s Telegram account was hijacked. The attacker impersonated the individual to contact targets, build trust, and then send fake Calendly video meeting invitations.
After victims clicked the link, they were directed to a fake Zoom domain controlled by the attacker. During the call, the attacker played a deepfake video of what appeared to be the CEO of another crypto company, and claimed there was an “audio malfunction,” tricking the target into running a supposed troubleshooting command on their computer. These commands triggered an infection chain on macOS and Windows systems, silently deploying up to seven malicious software programs.
Mandiant confirmed that these tools can steal Keychain credentials, browser cookies, login information, Telegram sessions, and local sensitive files. Researchers believe that the attackers aim both to directly acquire crypto assets and to gather intelligence for future scams. Deploying so many tools on a single device indicates a carefully planned targeted infiltration.
This incident is not isolated. By 2025, similar AI conference scams had caused losses exceeding $300 million; throughout the year, cyber operations related to North Korea stole approximately $2.02 billion in digital assets, a 51% increase. Chainalysis also pointed out that scam groups utilizing on-chain AI services are significantly more efficient than traditional methods.
As the barrier to deepfake technology continues to lower, the crypto industry faces unprecedented security challenges. Experts warn that online meetings involving funds and system permissions must strengthen multi-factor authentication and device isolation; otherwise, they could become the next attack vector.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Meta Unveils AI Tools for Facebook and WhatsApp to Deal With Crypto Scams
Meta has launched new AI tools for Facebook and WhatsApp aimed at detecting and preventing online and crypto scams. These advanced technologies will help protect users from fraudulent activities and create a safer digital space.
BlockChainReporter13m ago
BSC on-chain AM/USDT pool was attacked, resulting in a loss of approximately $131,000.
On March 12th, the AM/USDT liquidity pool on the BSC chain was attacked, resulting in a loss of approximately $131,000. The attacker exploited a flaw in the token burn mechanism to manipulate the AM reserves and price, profiting from the price increase.
GateNews1h ago
Many domestic universities strictly prohibit the use of OpenClaw due to its high-risk security vulnerabilities.
Gate News Announcement: On March 12,, Anhui Normal University, Jiangsu Normal University, Zhuhai University of Science and Technology, and other universities recently issued emergency notices prohibiting the installation and operation of the open-source AI intelligent agent OpenClaw ("Lobster") on campus office equipment and network environments. Violators will be dealt with seriously.
GateNews1h ago
Three men conspired to steal nearly $7 million worth of crypto assets from the SafeX platform, with the main culprit sentenced to 2 years in Singapore
Three men conspired to steal over $6.9 million in cryptocurrency from the SafeX trading platform, and 38-year-old Chinese man Zhang Xinghua was sentenced to two years for money laundering. The police have frozen $2.1 million in cryptocurrency, and the remaining $4.8 million cannot be recovered because it is stored in offshore wallets.
GateNews1h ago
The DBXen_crypto contract was attacked, resulting in a loss of approximately $150,000.
Gate News Report, March 12 — According to BlockSec monitoring, suspicious transactions targeting the DBXen_crypto contract were detected, estimated to have caused losses of approximately $150,000. The root cause is the inconsistency in the sender's identity in the ERC2771 meta-transaction, which allows attackers to manipulate the reward settlement logic and steal assets from the contract.
GateNews2h ago
AI scams escalate! Cryptocurrency ATM fraud losses may reach $333 million in 2025, with US complaints soaring by 33%
The report shows that with the use of AI and deepfake technology, cryptocurrency ATM scams in the United States are rapidly increasing, with losses expected to reach $333 million by 2025. Crypto ATMs are widely exploited due to low authentication standards, with seniors being significantly affected. The scams are diverse, and AI technology has enhanced the efficiency of fraud. Regulators have begun to pay attention and have proposed relevant legislation to strengthen protections.
GateNews3h ago
