BlueNoroff APT Launches AI-Enhanced Espionage on macOS, Using GPT-4o Images in Fake GhostCall Meetings

BlueNoroff, the North Korean APT group also known by names such as Sapphire Sleet, APT38 and TA444, has launched two intertwined campaigns dubbed GhostCall and GhostHire, expanding its macOS-focused espionage and financial-theft operations. According to Kaspersky, the campaigns show escalating sophistication, with AI-generated content used to enhance social-engineering realism, including enhanced GPT-4o imagery.

GhostCall targets blockchain executives and venture-capital leaders by inviting them to seemingly legitimate Zoom or Microsoft Teams meetings, where prerecorded videos create the illusion of a live discussion and a fraudulent prompt urges targets to update the Zoom SDK. The operation also involves a malicious AppleScript that downloads further payloads, with some images enhanced using GPT-4o and metadata indicating synthetic origin.

Kaspersky notes at least seven infection sequences—DownTroy, CosmicDoor, RooTroy, SneakMain, RealTimeTroy—plus a keylogger and SilentSiphon, a data-collection and exfiltration suite. The attackers have migrated from Rust to Nim and use multiple languages to diversify their malware, complicating attribution and detection.