BlueNoroff Uses Fake Zoom Calls to Turn Victims Into Attack Lures

darkreading

April 28, 2026 at 9:38 PM

Actively Exploited

Overview

A North Korean cyber group known as BlueNoroff is employing fake Zoom calls to target cryptocurrency executives. They are using stolen videos of victims and AI-generated avatars to create convincing impersonations, thereby tricking potential victims into downloading malware. This tactic allows the attackers to scale their operations effectively, posing a significant risk to individuals in the cryptocurrency sector. With the rise of remote communications, such sophisticated social engineering techniques could lead to increased vulnerabilities for professionals in this industry. Companies and individuals need to be aware of these tactics and take necessary precautions to protect themselves against such targeted attacks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Cryptocurrency executives and related organizations
Action Required: Users should verify the identity of individuals in video calls and use security measures such as two-factor authentication for sensitive transactions.
Timeline: Newly disclosed

Original Article Summary

The North Korean group is using stolen victim videos, AI-generated avatars, and fake Zoom calls to scale malware attacks against cryptocurrency executives.

Impact

Cryptocurrency executives and related organizations

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should verify the identity of individuals in video calls and use security measures such as two-factor authentication for sensitive transactions.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

Iranian Cyber Group Handala Targets US Troops in Bahrain

SecurityWeek

A cyber group from Iran, known as Handala, has reportedly targeted U.S. service members stationed in Bahrain. The group sent threatening messages via WhatsApp, warning troops that they would be attacked with drones and missiles. This incident raises concerns about the safety and security of military personnel in the region, especially given the increasing frequency of cyber threats aimed at U.S. forces. The nature of the messages suggests a deliberate attempt to instill fear and disrupt operations. Authorities are likely to investigate the source and intent behind these communications to ensure the safety of service members and assess any potential risks.

Apr 29, 2026

CISA, Microsoft warn of active exploitation of Windows Shell vulnerability (CVE-2026-32202)

Help Net Security

CISA and Microsoft have issued a warning about the exploitation of a Windows Shell vulnerability identified as CVE-2026-32202. This zero-click vulnerability allows attackers to trick victims' systems into authenticating with the attacker's server, potentially exposing sensitive information. CVE-2026-32202 is linked to an incomplete fix for a previous vulnerability (CVE-2026-21510), which was targeted by the APT28 group using malicious LNK files. Microsoft had released patches for these vulnerabilities in February 2026, but the new exploit indicates that attackers have found ways to bypass these security measures. Users and organizations running affected systems need to be vigilant and apply available updates to safeguard against these kinds of attacks.

Apr 29, 2026

A Quarter of Healthcare Organizations Report Medical Device Cyber-Attacks

Infosecurity Magazine

A recent report from RunSafe has found that about 25% of healthcare organizations have experienced cyber-attacks targeting their medical devices. These attacks often disrupt patient care, raising serious concerns about the security of devices such as infusion pumps and imaging systems. The report emphasizes that many healthcare providers are unprepared for these threats, which can lead to delays in treatment and pose risks to patient safety. As medical devices become more interconnected, the potential for cyber incidents increases, making it crucial for healthcare organizations to prioritize their cybersecurity measures. This situation underscores the urgent need for better security protocols in the healthcare sector to protect both patients and medical systems.

Apr 29, 2026

38 Vulnerabilities Found in OpenEMR Medical Software

SecurityWeek

A recent security assessment has identified 38 vulnerabilities in OpenEMR, a widely used medical software platform. Some of these vulnerabilities could allow attackers to access and modify sensitive patient information, raising significant concerns for healthcare providers that rely on this software to manage patient records. Given the critical nature of health data, these vulnerabilities pose a serious risk to patient privacy and safety. OpenEMR users, including medical practices and clinics, should take immediate action to secure their systems. The findings emphasize the need for regular security audits and timely updates to safeguard against potential breaches.

Apr 29, 2026

Cursor AI IDE vulnerability allows code execution via hidden Git hooks

Hackread – Cybersecurity News, Data Breaches, AI and More

Researchers at Novee have identified a serious vulnerability in Cursor AI, designated as CVE-2026-26268. This flaw could allow attackers to execute malicious code when developers clone repositories, potentially compromising their systems. The vulnerability is particularly concerning for those using Cursor AI in their development workflows, as it opens up a pathway for exploitation that could lead to data breaches or the introduction of harmful code. Developers and organizations using this integrated development environment should take immediate action to assess their systems for this vulnerability and understand the risks involved. Awareness and prompt remediation are crucial to maintaining security in software development processes.

Apr 29, 2026

Critical GitHub Vulnerability Exposed Millions of Repositories

SecurityWeek

A significant vulnerability, identified as CVE-2026-3854, has been discovered in GitHub.com and GitHub Enterprise Server, potentially allowing remote code execution. This flaw poses a risk to millions of repositories hosted on these platforms, which are widely used by developers and organizations for version control and collaboration. If exploited, attackers could execute arbitrary code, leading to unauthorized access and manipulation of sensitive codebases. The discovery emphasizes the need for users to remain vigilant and update their systems promptly to mitigate potential risks. GitHub has urged users to apply the latest patches to safeguard their repositories against this vulnerability.

Apr 29, 2026