North Korean Hackers Reportedly Using Fake AI Zoom Calls

Cybersecurity researchers and cryptocurrency industry observers are warning of a new wave of sophisticated attacks allegedly linked to North Korean hacking groups, involving artificial intelligence-generated video calls designed to trick cryptocurrency users and steal access to digital wallets.

The reported campaign uses fake Zoom meetings with AI-generated faces that mimic trusted contacts, creating a realistic social engineering attack targeting cryptocurrency professionals and wallet holders.

The information was highlighted by cryptocurrency-focused sources, including the X account @coinbureau, which reported that attackers are using AI-powered deepfake technology combined with compromised communication accounts to attack individuals involved in the digital asset industry.

According to the reported details, the attackers first gain control of Telegram accounts belonging to trusted crypto contacts. After taking over these accounts, hackers use the identity of known people to send fake meeting invitations and encourage victims to join fraudulent video calls.

The approach leverages one of the most effective methods of modern cybercrime: exploiting trust.

Instead of sending obvious phishing messages from unknown accounts, attackers try to appear as legitimate business partners, investors, colleagues, or industry contacts. By using familiar identities, they increase the likelihood that victims will participate in fake meetings.

Once a target joins the fraudulent Zoom call, attackers allegedly use AI-generated faces designed to mimic real individuals. The technology creates the appearance of a familiar person while using pre-recorded movements and facial features to make the interaction appear more convincing.

The development highlights the growing role of artificial intelligence in cybersecurity threats. While AI has created significant opportunities in areas such as automation, research and communication, criminals are increasingly using the technology to create more advanced scams.

Deepfake technology allows attackers to generate realistic-looking video and audio content that can imitate real people. In the past, many online scams relied on fake emails or simple phishing tactics. Today, criminals can combine stolen identities, AI-generated images, and social engineering techniques to create much more convincing attacks.

For cryptocurrency users, these threats present significant risks. Digital asset wallets are often targeted because they can provide direct access to valuable funds. Unlike traditional financial systems, cryptocurrency transactions are typically irreversible, meaning stolen assets may be difficult or impossible to recover.

The reported attacks focus on browser-based cryptocurrency wallets, which are widely used by investors, traders, and blockchain professionals. These wallets provide convenient access to digital assets, but can become vulnerable if users unknowingly install malicious software or reveal sensitive information.

Source: Xpost

According to reported campaign details, attackers use fake meeting links as part of their strategy. These links can take victims to malicious websites or downloads designed to compromise their devices.

After gaining access, hackers may attempt to scan browser wallet extensions or collect information that could allow them to access cryptocurrency accounts.

The use of compromised Telegram accounts adds another layer of credibility to the attack. Many cryptocurrency communities rely heavily on Telegram to communicate, making it a valuable target for cybercriminal groups.

A message coming from a known contact can appear much more trustworthy than a random phishing attempt. Attackers understand this psychological advantage and use it to increase their chances of success.

Security experts have repeatedly warned that social engineering remains one of the biggest challenges facing the cryptocurrency sector. Even advanced security systems can be circumvented if attackers manage to manipulate human behavior.

The alleged campaign linked to North Korea demonstrates how cybercriminals are combining multiple technologies and techniques. Account hijacking, AI-generated media, fake video chats, and malware distribution are used together to create highly targeted attacks.

North Korean hacker groups have previously been associated with cryptocurrency-related cyber operations. International cybersecurity organizations have reported that certain groups connected to North Korea have targeted digital asset companies and cryptocurrency users as part of broader cyber activities.

Cryptocurrency theft has become a major concern within the global cybersecurity community. Digital assets provide attackers with attractive targets because blockchain transactions can move quickly across borders and can be difficult to trace once stolen.

The emergence of AI-powered deepfake attacks could make these threats more challenging in the future. Traditional security controls, such as recognizing a familiar face or voice, may become less reliable as AI technology improves.

Experts advise cryptocurrency users and companies to adopt stricter verification procedures when handling sensitive information or financial transactions.

A familiar face on a video call should no longer be considered complete proof of identity. Organizations may need to implement additional verification steps, such as confirming meeting requests through separate communication channels or using authentication methods that do not rely solely on visual recognition.

Companies operating in the cryptocurrency sector are especially encouraged to strengthen their employee training programs. Staff members who regularly communicate with investors, developers, or external partners can become prime targets for sophisticated phishing attacks.

Security awareness is increasingly important as attackers move beyond traditional phishing emails and adopt more advanced methods.

The reported campaign also reflects a broader shift in the cybersecurity landscape. Artificial intelligence is changing both sides of the security battle, providing new tools for defenders while giving attackers the ability to create more convincing scams.

For cryptocurrency users, maintaining basic security practices remains essential. Among the most important steps users can take are avoiding unknown downloads, verifying unexpected meeting requests, protecting messaging accounts with strong authentication, and keeping wallet security information private.

Browser wallet users should also be careful when installing software or allowing permissions on websites. Malware designed to monitor browser activity or access wallet extensions can pose serious financial risks.

The cryptocurrency industry has become a frequent target for cybercriminal groups due to the large amount of digital value stored on blockchain networks. As adoption increases, attackers are expected to continue developing new methods to exploit both technology and human behavior.

The reported use of AI-generated Zoom calls represents another stage in the evolution of online fraud. Instead of relying solely on fake messages or websites, attackers are now trying to create realistic digital interactions that can fool even experienced users.

The challenge for the industry will be to find ways to maintain trust and security in an environment where digital identities can be increasingly manipulated.

AI-based threats are likely to remain a major cybersecurity issue for years to come. Businesses, investors, and everyday cryptocurrency users will need to adapt by combining stronger technical protections with greater awareness of the risks of social engineering.

The reported deepfake campaign serves as a reminder that cybersecurity is no longer just about protecting devices and networks. It’s also about verifying identities, challenging unusual requests, and understanding how criminals use emerging technologies.

As hackers continue to experiment with AI-based methods, cryptocurrency users are urged to be cautious and verify communications before taking any action involving digital assets.