North Korean Hackers Target Web3 Startups with Sophisticated Zoom Phishing Scheme

North Korean state-sponsored hackers have escalated attacks on cryptocurrency startups using advanced social engineering tactics. SentinelLabs uncovered a multi-stage operation where attackers impersonate trusted contacts via Telegram, then lure victims to malicious Calendly scheduling pages disguised as Zoom meeting invitations.

The campaign employs meticulously crafted spoof domains resembling legitimate Zoom URLs, such as support.us05web-zoom.forum. Attackers distribute AppleScript files containing thousands of lines of whitespace to conceal three critical lines of malicious code. These payloads download additional modules from hacker-controlled servers, enabling systemic data exfiltration from compromised Mac systems.

This operation highlights growing cybersecurity risks in the Web3 ecosystem, particularly for cryptocurrency projects handling sensitive wallet information and smart contract code. The attack methodology demonstrates concerning evolution in DPRK's offensive cyber capabilities, blending psychological manipulation with technical sophistication.