North Korean state linked hackers are expanding their attacks on the cryptocurrency industry by compromising Telegram accounts and using them to trick Bitcoin and crypto professionals into installing malware. Security researchers say the campaign marks another evolution in Pyongyang’s long running effort to steal digital assets and sensitive credentials that can help finance the country’s sanctioned activities.
The latest findings show that attackers first gain control of legitimate Telegram accounts belonging to executives or employees in the crypto and fintech sectors. They then use those trusted identities to contact colleagues, investors, and business partners before inviting them to seemingly legitimate online meetings. During these fake meetings, victims are instructed to install software or run commands to resolve fabricated technical issues, ultimately infecting their devices with malware.
Trusted Accounts Become the Entry Point
Researchers say the attackers rely heavily on social engineering rather than technical exploits. By hijacking real Telegram accounts, they bypass the skepticism that often surrounds unsolicited messages.
The campaign typically follows several steps:
- Compromise a trusted Telegram account.
- Build credibility through routine conversations.
- Schedule a fake Zoom or video meeting.
- Convince the victim to install a supposed audio or software fix.
- Deploy malware that steals credentials, browser data, and cryptocurrency wallet information.
Investigators identified multiple malware families designed to maintain long term access while collecting sensitive information from infected systems. The operation primarily targets cryptocurrency companies, software developers, venture capital firms, and other organizations that manage or invest in digital assets.
Growing Threat to the Crypto Industry
Cybersecurity experts warn that North Korean threat groups continue to refine their techniques by combining compromised messaging accounts, sophisticated social engineering, and in some cases AI generated deepfake videos to increase credibility. Rather than directly attacking blockchain networks, the hackers increasingly focus on employees with privileged access to wallets, cloud infrastructure, and internal systems.
The campaign highlights the growing importance of verifying unexpected meeting requests, even when they originate from familiar Telegram contacts. Security professionals recommend confirming invitations through separate communication channels, avoiding unknown software downloads, and enabling strong account protections to reduce the risk of compromise.
