Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs

BlueNoroff has been active with two major campaigns, GhostCall and GhostHire, aimed at Web3 and blockchain industry targets such as developers, executives, and venture capitalists. GhostCall uses fake online meetings—initially Zoom, later shifting to Microsoft Teams—delivered via Telegram messages, with victims invited to fake calls that replay real victims’ video feeds and then prompt a Zoom SDK update that actually installs malware on macOS.

In GhostCall, researchers identified seven distinct multi‑component infection chains, including a stealer and a keylogger, and observed extensive data harvesting from hosts, such as wallet details, Keychain, browser credentials, and Telegram data. GhostHire targets Web3 developers through a recruitment‑style flow on Telegram and GitHub, pressuring victims to run a malicious project; it also employs AI in various attack aspects and uses a Telegram bot to deliver the payload.

Since April 2025, the campaigns have shared infrastructure and tools, with GhostHire overlapping GhostCall but using a different malware set. Victims have been reported in Japan, Italy, France, Singapore, Turkey, Spain, Sweden, India, Hong Kong, Australia, and other APAC locations, with many stolen items posted publicly by the attackers.