BlueNoroff Shifts Tactics: Targets C-Suite and Managers with New Infiltration Methods

BlueNoroff, the North Korean-linked threat group also known as Sapphire Sleet, APT38 and Alluring Pisces, has shifted its attack tactics to target high-value victims such as C-suite executives, managers and blockchain developers in Web3 and venture capital sectors, according to GBHackers.

Researchers identified two campaigns, GhostCall and GhostHire, combining social engineering with advanced malware delivery, and the operation has evolved to use carefully crafted phishing via Telegram, with calendars scheduled through Calendly to direct targets to fake Zoom interfaces.

Victims are lured to join what appears to be a live Zoom call, where recordings from previous victims are replayed to create a convincing illusion before malware is installed, including ZoomClutch that steals macOS passwords and prompts for credentials via a fake Zoom dialog. GhostHire targets Web3 developers through recruitment fraud, delivering ZIP files or GitHub links that contain malicious code, and pressures victims with 30-minute deadlines to accelerate execution.

The campaigns involve seven distinct multi-component infection chains and have been tracked since at least April 2025, with ongoing sightings across social media platforms.