A sophisticated North Korean Advanced Persistent Threat (APT) group has been identified deploying malware through weaponized meeting scheduling platforms, targeting cryptocurrency organizations with an elaborate social engineering campaign that combines deepfake technology, legitimate meeting tools, and advanced macOS malware.
The attack chain begins with seemingly innocent Calendly invitations but ultimately delivers a comprehensive surveillance and cryptocurrency theft toolkit capable of keylogging, screen capture, and wallet extraction across multiple platforms.
The campaign, attributed to the North Korean state-sponsored group TA444, also known as BlueNoroff, Sapphire Sleet, or CageyChameleon, represents a significant evolution in their targeting methodology.
.webp)
Unlike traditional phishing campaigns, this operation leverages the trust inherent in professional meeting scheduling tools to establish initial contact with high-value targets in the cryptocurrency sector.
The attackers demonstrate remarkable patience, with the initial contact occurring weeks before the actual payload delivery, allowing them to build credibility and lower target suspicions.
Huntress analysts identified this intrusion following a partner report on June 11, 2025, regarding a potentially malicious Zoom extension download by an end user at a cryptocurrency foundation.
The investigation revealed that the victim had received the initial lure several weeks prior through their Telegram account, where an external contact requested meeting time and provided a Calendly link for scheduling a Google Meet event.
The attack’s sophistication becomes apparent in its execution phase, where victims join what appears to be a legitimate group meeting containing deepfakes of known senior leadership from their own company alongside external contacts.
During these fabricated meetings, targets are told they need to download a Zoom extension to resolve microphone issues, with the malicious link distributed via Telegram directing them to hxxps[://]support[.]us05web-zoom[.]biz/troubleshoot-issue-727318.
This domain masquerades as official Zoom support infrastructure while hosting the initial AppleScript payload.
The downloaded file, zoom_sdk_support.scpt, serves as the primary infection vector, containing over 10,500 blank lines designed to obscure its malicious functionality.
The script initially opens a legitimate Zoom SDK webpage to maintain the illusion of authenticity, but subsequently downloads and executes additional payloads from the attacker-controlled infrastructure.
Infection Mechanism and Technical Implementation
The AppleScript dropper implements several sophisticated evasion and preparation techniques before deploying its primary payload.
The script begins by disabling bash history logging using unset HISTFILE and checking for Rosetta 2 installation to ensure compatibility with x86_64 binaries on Apple Silicon systems.
If Rosetta 2 is not present, the script silently installs it using softwareupdate --install-rosetta --agree-to-license, ensuring the attack can proceed regardless of the target system’s architecture.
The infection process continues with the creation of a hidden file called .pwd and downloads the main payload to /tmp/icloud_helper using a curl request with the distinctive user agent cur1-mac-s, which has been observed in previous BlueNoroff operations.
The malware then attempts to extract the user’s password through repeated sudo verification attempts, continuing until valid credentials are supplied, before removing shell history files including ~/.zsh_history, ~/.bash_history, and ~/.zsh_sessions to eliminate forensic evidence.
This multi-stage approach ultimately deploys eight different malicious binaries, including the persistent Nim-based implant “Telegram 2,” the Go-based backdoor “Root Troy V4,” and specialized tools for keylogging, screen capture, and cryptocurrency wallet theft, demonstrating the campaign’s comprehensive surveillance and financial theft objectives.
Power up early threat detection, escalation, and mitigation with ANY.RUN’s Threat Intelligence Lookup. Get 50 trial searches.
