North Korean Hackers Use Deepfake Video Calls to Target Crypto Firms

Infosecurity Magazine

February 11, 2026 at 4:35 PM

Actively Exploited

Overview

North Korean hackers have launched a sophisticated campaign targeting cryptocurrency firms by using deepfake video calls to impersonate legitimate company representatives. These attackers have stolen Telegram accounts and are conducting fake Zoom meetings to trick users into installing infostealer malware. This malware is designed to harvest sensitive information, which could lead to significant financial losses for the affected companies. The use of deepfake technology in these scams highlights a concerning trend in cybercrime, where attackers are becoming increasingly adept at using advanced tactics to deceive their targets. Cryptocurrency firms, already vulnerable to various cyber threats, must remain vigilant against such innovative attack methods.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Cryptocurrency firms, Telegram accounts, Zoom
Action Required: Companies should implement multi-factor authentication, educate employees about deepfake technology, and monitor communications for suspicious activity.
Timeline: Newly disclosed

Original Article Summary

Campaign combines stolen Telegram accounts, fake Zoom calls and ClickFix attacks to deploy infostealer malware

Impact

Cryptocurrency firms, Telegram accounts, Zoom

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Companies should implement multi-factor authentication, educate employees about deepfake technology, and monitor communications for suspicious activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

Your AI doctor doesn’t have to follow the same privacy rules as your real one

CyberScoop

AI applications are increasingly entering the healthcare space, but they may not be required to follow the same privacy regulations that traditional healthcare providers must adhere to. This raises concerns about how patient data is handled, as there is no guarantee that these AI tools will implement stringent data security measures. Patients using AI for medical advice might be at risk of their personal health information being mismanaged or inadequately protected. As healthcare technology evolves, it's crucial for users to be aware of the potential privacy implications and for regulators to consider updating laws to keep pace with these advancements. The situation calls for careful scrutiny to ensure that patient rights are upheld in an increasingly digital healthcare environment.

Feb 11, 2026

AI-generated React2Shell malware infects 90-plus hosts

SCM feed for Latest

Researchers have recently identified a new strain of malware named React2Shell, which has infected over 90 hosts. This malware, discovered through a Docker honeypot, is primarily used for cryptojacking, a practice where attackers hijack computing resources to mine cryptocurrency without the owner's consent. The emergence of React2Shell signals a growing trend in the use of artificial intelligence to create more sophisticated malware. Organizations need to be vigilant about their Docker environments and ensure they have robust security measures in place to protect against such threats. The impact of this malware could lead to significant financial losses for businesses if their systems are compromised.

Feb 11, 2026

Is spyware hiding on your phone? How to find out and remove it - fast

Conduent Breach Hits Volvo Group: Nearly 17,000 Employees’ Data Exposed

SecurityWeek

A recent data breach involving Conduent has compromised the personal information of nearly 17,000 employees at Volvo Group, part of a much larger incident affecting at least 25 million individuals. Initially thought to involve only 10 million people, the breach has expanded significantly, raising concerns about data security across numerous organizations. The exposed data could include sensitive information, putting affected employees at risk for identity theft and other malicious activities. This incident emphasizes the need for companies to bolster their cybersecurity measures and protect sensitive employee data. The breach's scale indicates a potential vulnerability in third-party vendor systems, which can have widespread implications for many businesses relying on such services.

Feb 11, 2026

Ivanti Patches Endpoint Manager Vulnerabilities Disclosed in October 2025

SecurityWeek

Ivanti has addressed a serious security flaw in its Endpoint Manager software, which was disclosed in October 2025. A high-severity authentication bypass vulnerability was identified, allowing attackers to remotely exploit the system without needing any form of authentication. This means that unauthorized users could potentially gain access to sensitive credentials. The implications of this vulnerability are significant, as it could expose organizations to data breaches and unauthorized access. Users of Ivanti Endpoint Manager are strongly encouraged to apply the latest patches to secure their systems and safeguard their information.

Feb 11, 2026

Microsoft Patch Tuesday: 6 exploited zero-days fixed in February 2026

Help Net Security

In February 2026, Microsoft addressed over 50 security vulnerabilities during its Patch Tuesday update, including six zero-day flaws that were actively exploited by attackers. Notably, three of these zero-days involve security feature bypasses. One of the vulnerabilities, identified as CVE-2026-21513, impacts the MSHTML/Trident browser engine used in Internet Explorer on Windows, while CVE-2026-21514 affects Microsoft Word. Attackers can exploit these vulnerabilities by tricking users into opening malicious files or links. As these security holes are actively being exploited, users and organizations must apply the updates promptly to protect their systems from potential breaches.

Feb 11, 2026