A financially motivated North Korean threat actor (tracked as UNC1069) is targeting cryptocurrency firms using deepfake-powered social engineering and advanced ClickFix techniques.
According to Google Cloud’s Mandiant, attackers:
🎭 Compromised a real crypto executive’s Telegram account
📅 Sent a legitimate-looking Calendly invite
🎥 Directed victims to a spoofed Zoom meeting hosted on attacker infrastructure
🤖 Used a deepfake video to simulate technical issues
💻 Convinced victims to run a single malicious command on macOS or Windows
That command triggered a full infection chain — installing backdoors, deploying additional tooling, and harvesting:
🔐 Keychain credentials
🌐 Browser data
💬 Telegram data
📝 Apple Notes data
UNC1069 has shifted away from traditional spear-phishing and is now focused on the Web3 ecosystem, including:
• Crypto exchanges
• Software developers
• Venture capital firms
• Executives and high-value individuals
The group reportedly utilizes LLMs (such as Gemini) to research targets and refine social engineering techniques.
Why this matters
This isn’t malware-first — it’s trust-first.
Deepfakes + legitimate platforms + user-executed commands = full compromise.
A few lines of code are all it takes.
Defensive Takeaways
• Never run commands shared during “troubleshooting” sessions
• Verify meeting requests via a second channel
• Restrict execution permissions where possible
• Monitor for unusual Telegram / Zoom / Calendly activity
