Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs

BlueNoroff is a financially motivated threat actor conducting sophisticated campaigns named GhostCall and GhostHire targeting macOS, Windows, and Linux systems. GhostCall focuses on tech executives and venture capitalists via fake Zoom-like meetings, while GhostHire targets Web3 developers through fraudulent recruitment processes. These campaigns deploy multi-stage malware including ZoomClutch, DownTroy, CosmicDoor, RooTroy, and SilentSiphon, leveraging social engineering and AI-generated images. The attacks aim beyond cryptocurrency theft, focusing on comprehensive data acquisition to enable supply chain attacks and exploit trust relationships. The threat involves complex malware chains and advanced persistence techniques, affecting high-value targets in the tech and crypto sectors. Exploitation requires user interaction but no prior authentication, increasing risk. The campaigns pose a medium severity threat with significant potential impact on confidentiality and integrity. European organizations involved in technology, venture capital, and blockchain development are particularly at risk, especially in countries with strong tech ecosystems. Mitigation requires targeted user awareness, enhanced endpoint detection, and strict verification of recruitment and meeting invitations.

• 16 Malicious Firefox Extensions Steal Cryptocurrency Wallet CredentialsCampaign2026-10-08
• New PamStealer variant targets macOS via fake crypto walletMalware2026-09-22
• CARBONATO: a botnet built around an AI agentMalware2026-09-24
• Scammers are using fake crypto AML checkers to drain your walletMalware2026-08-19
• Octagon: A New Android Bot Targeting Crypto Wallets and Banking AppsMalware2026-08-18