The North Korean hacking group BlueNoroff has escalated their cyber operations by using AI-generated deepfakes of company executives during Zoom calls to deceive employees into installing malware on macOS devices.
## The Attack Method
BlueNoroff, also known as Sapphire Sleet or TA444, is an advanced persistent threat group specializing in cryptocurrency theft through Windows and Mac malware. Huntress researchers discovered their latest campaign in June 2025 while investigating a network intrusion at a partner organization.
The attack begins with threat actors contacting targets via Telegram, posing as external professionals requesting meetings. They send Calendly links that appear to lead to Google Meet sessions but actually redirect to fake Zoom domains controlled by the attackers.
During these fraudulent video calls, the hackers deploy deepfake technology to impersonate senior company leadership and external participants, creating a convincing illusion of legitimacy. When victims experience “microphone issues” during the call, the fake executives recommend downloading a supposed Zoom extension to fix the problem.
## The Malware Payload
The malicious fix comes as an AppleScript file (zoom_sdk_support.scpt) delivered through Telegram. While the script initially opens a legitimate Zoom SDK webpage, it contains over 10,500 blank lines before executing malicious commands that download and install secondary payloads from attacker-controlled domains.
The malware performs several sophisticated operations:
– Disables bash history logging to avoid detection
– Installs Rosetta 2 if needed to run x86_64 binaries on Apple Silicon Macs
– Creates hidden files and downloads additional payloads
## Arsenal of Mac Malware
Researchers identified eight distinct malicious binaries in this campaign, including:
**Telegram 2**: A Nim-based persistence tool disguised as a legitimate Telegram updater, signed with a valid developer certificate to evade detection.
**Root Troy V4**: A Go-based backdoor enabling remote code execution and payload downloads, serving as the central command controller.
**XScreen**: A surveillance component that logs keystrokes, records screens, and monitors clipboard activity.
**CryptoBot**: A cryptocurrency-focused information stealer targeting over 20 wallet platforms, extracting sensitive data for theft operations.
## Growing macOS Threats
This campaign demonstrates BlueNoroff’s increasing sophistication, combining AI deepfakes with custom macOS malware. Security experts warn that Mac users’ traditional sense of security may be misplaced, as threat actors increasingly target macOS due to its growing enterprise adoption.
The attack highlights the need for enhanced security awareness and protection measures among macOS users, particularly in organizations handling cryptocurrency or sensitive financial data. As AI technology becomes more accessible, deepfake-enabled social engineering attacks are likely to become more common across all platforms.