North Korean Hackers Reportedly Use AI Deepfake Zoom Calls

Cybersecurity researchers and cryptocurrency industry observers are warning about a new wave of sophisticated attacks allegedly linked to North Korean hacking groups, involving artificial intelligence-generated video calls designed to trick cryptocurrency users and steal access to digital wallets.

The reported campaign uses fake Zoom meetings featuring AI-generated faces that imitate trusted contacts, creating a realistic social engineering attack aimed at cryptocurrency professionals and wallet holders.

The information was highlighted by cryptocurrency-focused sources, including the X account @coinbureau, which reported that attackers are using artificial intelligence-powered deepfake technology combined with compromised communication accounts to target individuals involved in the digital asset industry.

According to the reported details, the attackers first gain control of Telegram accounts belonging to trusted crypto contacts. After taking over these accounts, hackers use the identity of familiar people to send fake meeting invitations and encourage victims to join fraudulent video calls.

The approach takes advantage of one of the most effective methods in modern cybercrime: exploiting trust.

Instead of sending obvious phishing messages from unknown accounts, attackers attempt to appear as legitimate business partners, investors, colleagues, or industry contacts. By using familiar identities, they increase the likelihood that victims will participate in the fake meetings.

Once a target joins the fraudulent Zoom call, the attackers reportedly use artificial intelligence-generated faces designed to imitate real individuals. The technology creates the appearance of a known person while using previously recorded movements and facial characteristics to make the interaction appear more convincing.

The development highlights the growing role of artificial intelligence in cybersecurity threats. While AI has created significant opportunities in areas such as automation, research, and communication, criminals are increasingly using the technology to create more advanced scams.

Deepfake technology allows attackers to generate realistic-looking video and audio content that can imitate real people. In the past, many online scams relied on fake emails or simple impersonation tactics. Today, criminals can combine stolen identities, AI-generated images, and social engineering techniques to create much more convincing attacks.

For cryptocurrency users, these threats present significant risks. Digital asset wallets are often targeted because they can provide direct access to valuable funds. Unlike traditional financial systems, cryptocurrency transactions are usually irreversible, meaning stolen assets can be difficult or impossible to recover.

The reported attacks focus on browser-based cryptocurrency wallets, which are widely used by investors, traders, and blockchain professionals. These wallets provide convenient access to digital assets but can become vulnerable if users unknowingly install malicious software or reveal sensitive information.

Source: Xpost

According to the reported campaign details, attackers use fake meeting links as part of their strategy. These links may lead victims toward malicious websites or downloads designed to compromise their devices.

After gaining access, hackers may attempt to scan browser wallet extensions or collect information that could allow them to access cryptocurrency accounts.

The use of compromised Telegram accounts adds another layer of credibility to the attack. Many cryptocurrency communities rely heavily on Telegram for communication, making it a valuable target for cybercriminal groups.

A message coming from a known contact can appear far more trustworthy than a random phishing attempt. Attackers understand this psychological advantage and use it to increase their chances of success.

Security experts have repeatedly warned that social engineering remains one of the biggest challenges facing the cryptocurrency sector. Even advanced security systems can be bypassed if attackers successfully manipulate human behavior.

The reported North Korean-linked campaign demonstrates how cybercriminals are combining multiple technologies and techniques. Account hijacking, artificial intelligence-generated media, fake video conferences, and malware delivery are being used together to create highly targeted attacks.

North Korean hacking groups have previously been associated with cryptocurrency-related cyber operations. International cybersecurity organizations have reported that certain groups connected to North Korea have targeted digital asset companies and cryptocurrency users as part of broader cyber activities.

Cryptocurrency theft has become an important concern within the global cybersecurity community. Digital assets provide attackers with attractive targets because blockchain transactions can move quickly across borders and may be difficult to trace once stolen.

The emergence of AI-powered deepfake attacks could make these threats more challenging in the future. Traditional security checks, such as recognizing a familiar face or voice, may become less reliable as artificial intelligence technology improves.

Experts advise cryptocurrency users and businesses to adopt stronger verification procedures when handling sensitive information or financial transactions.

A familiar face on a video call should no longer be considered complete proof of identity. Organizations may need to implement additional verification steps, such as confirming meeting requests through separate communication channels or using authentication methods that do not rely solely on visual recognition.

Companies operating in the cryptocurrency sector are particularly encouraged to strengthen employee training programs. Staff members who regularly communicate with investors, developers, or external partners may become prime targets for sophisticated impersonation attacks.

Security awareness is becoming increasingly important as attackers move beyond traditional phishing emails and adopt more advanced methods.

The reported campaign also reflects a wider shift in the cybersecurity landscape. Artificial intelligence is changing both sides of the security battle, providing new tools for defenders while also giving attackers the ability to create more convincing scams.

For cryptocurrency users, maintaining basic security practices remains essential. Avoiding unknown downloads, verifying unexpected meeting requests, protecting messaging accounts with strong authentication, and keeping wallet security information private are among the most important steps users can take.

Browser wallet users should also remain cautious when installing software or allowing website permissions. Malicious programs designed to monitor browser activity or access wallet extensions can create serious financial risks.

The cryptocurrency industry has become a frequent target for cybercriminal groups because of the large amount of digital value stored within blockchain networks. As adoption increases, attackers are expected to continue developing new methods to exploit both technology and human behavior.

The reported use of AI-generated Zoom calls represents another stage in the evolution of online fraud. Instead of relying only on fake messages or websites, attackers are now attempting to create realistic digital interactions that can deceive even experienced users.

The challenge for the industry will be finding ways to maintain trust and security in an environment where digital identities can be increasingly manipulated.

Artificial intelligence-based threats are likely to remain a major cybersecurity issue in the coming years. Companies, investors, and everyday cryptocurrency users will need to adapt by combining stronger technical protections with greater awareness of social engineering risks.

The reported deepfake campaign serves as a reminder that cybersecurity is no longer only about protecting devices and networks. It is also about verifying identities, questioning unusual requests, and understanding how criminals use emerging technologies.

As hackers continue experimenting with AI-driven methods, cryptocurrency users are being urged to remain cautious and verify communications before taking any action involving digital assets.