North Korea's BlueNoroff Expands Scope of Crypto Heists

North Korea’s Blue Noroff APT is expanding beyond its macOS focus into Windows and cross-platform campaigns aimed at crypto platforms, insiders say, as it uses social engineering and AI to speed up operations, according to Kaspersky. Two campaigns, GhostCall and GhostHire, target tech and VC executives and Web3 developers respectively, with GhostCall delivering Zoom-like phishing and Telegram-driven collaboration lures, and GhostHire distributing malware via a GitHub repository disguised as a DeFi project.

The campaigns employ a multi-stage infection chain and a unified command-and-control infrastructure, and researchers note the actor is broadening its toolset and capabilities, including a Windows version of CosmicDoor and the use of uniroute, a Go package project published on April 9 this year. GhostHire adapts to the user’s platform by selecting payloads based on the user agent, and the fake recruitment process pressures victims to act quickly, culminating in malicious downloads.

The disclosures come from a blog post by researchers at Kaspersky, with additional observations from other security vendors tracking BlueNoroff’s evolving malware chains and data-collection ambitions. Elizabeth Montalbano, Dark Reading’s contributing writer, reported this on 28 October 2025. According to Kaspersky, the actor’s AI-powered, tailored approach enhances precision and operational speed in these campaigns.