Deepfake Zoom Scams Hit Crypto Insiders as BTC Prague Co-Founder Warns of Mac Malware

Key Takeaways:

Crypto insiders are being focused by deepfake video calls that ship macOS malwareBTC Prague co-founder Martin Kuchař says his stolen Telegram account was used to unfold the assaultThe marketing campaign matches techniques tied to North Korea–linked BlueNoroff hackers

A crypto rip-off wave with a highly-targeted degree is exploiting deepfake video, relationship contacts and widespread work instruments. BTC Prague co-founder, Martin Kuchař disclosed that attackers managed his Telegram account to lure others into Zoom and Groups video name with malware.

Please, assist me to cease 🛑 these scammers. Report this TG account which was stolen from me and is broadly used to unfold the assault in my title now. https://t.co/RHDWF9Qvpy pic.twitter.com/Sdepa8MH8w

— Martin Kuchař (@kucharmartin_) January 26, 2026

Learn Extra: $50M Vanishes in Seconds: Copy-Paste Pockets Error Triggers One in all Crypto’s Costliest Handle Scams

Deepfake Video Calls Used because the Entry Level

Kuchař warned that the assaults usually begin with messages from trusted contacts on Telegram or different platforms. The victims obtain an invite to debate the matter or even have a fast sync in a Zoom or Microsoft Groups name.

After getting the decision, the attackers impersonate the trusted particular person by means of AI-generated deepfake video. They state that there’s an audio downside and request the sufferer to put in a given plug in or file in order to resolve the difficulty. That file provides attackers full entry to the system.

Based on Kuchař, this methodology led to the theft of Bitcoin, takeover of Telegram accounts, and additional unfold of the rip-off by means of hijacked identities. He urged customers to deal with all Telegram messages as untrusted and to keep away from unverified Zoom or Groups calls.

Learn Extra: Hackers Hijack Binance Co-CEO Yi He’s WeChat to Push Meme Coin Rip-off, Triggering Market Frenzy

North Korea–Linked Malware Chain Targets Mac Customers

Technical particulars shared by Kuchař align with analysis from cybersecurity agency Huntress, which traced comparable assaults to BlueNoroff, a hacking group linked to North Korea’s Lazarus Group.

How the Mac An infection Works

The assault begins with a spoofed Zoom area with a faked assembly hyperlink. When victims are making the decision, they’re suggested to obtain a file named Zoom assist script. Truly, the file is contaminated by AppleScript, which begins a multi-stage assault.

The malware toolkit will include:

Telegram 2, a pretend updater that maintains persistenceRoot Troy V4, a remote-access backdoorInjectWithDyld, a stealth loader for encrypted payloadsXScreen, a surveillance device that logs keystrokes and display exerciseCryptoBot, an infostealer focusing on greater than 20 crypto wallets

Researchers point out that the malware will leverage legitimate developer signatures and place Rosetta on Apple Silicon units so as to evade identification. This renders the assault much less detectable, notably to the Mac customers who’ve a false sense of safety that their respective techniques are much less weak.

Crypto Theft Campaigns Develop Extra Refined

Huntress researchers level out that Mac is a superb goal as a result of an growing variety of crypto teams deploy Macs to the enterprise. Deepfake video injects strongly within the credibility equation, combining real-time photos with the identified platform.

Fundamental safety habits revealed by Kuchař assisted in curbing his losses. He emphasised using two-factor authentication, password resolution, and {hardware} wallets. He additionally beneficial safer communication instruments, resembling Sign or Jitsi, and higher browsers over safer calls, resembling Google Meet on account of better sandboxing.