BlueNoroff’s Fake Meeting Kit Hijacks Webcams, Disables Defender, and Drains Crypto Wallets
The kit lures victims via hijacked Telegram contacts into cloned Zoom or Teams pages that silently turn on webcams, suppress Windows Defender, and fingerprint browser wallets using EIP‑6963 before delivering a malicious payload. By profiling wallets first, the attackers can prioritize high‑value crypto theft, showing a new, state‑backed social‑engineering chain targeting Web3 users.