DeepfakeHigh
North Korea-Linked Actors Allegedly Use AI Executive Deepfakes in Zoom Phishing Targeting Web3 Employee
- Occurred
- Jun 22, 2025
- Published
- Jun 22, 2025
- Source
- AI Incident Database
Summary
An alleged phishing scheme involving actors linked to North Korea used purported AI-generated deepfake videos of company executives to deceive a Web3 employee during a fake Zoom call. The target was reportedly tricked into installing macOS malware disguised as a "Zoom extension," leading to the deployment of spyware, a keylogger, and a crypto wallet stealer. The attackers reportedly used Telegram and spoofed Zoom domains to orchestrate the breach.
Developers
- Deepfake technology developers
- Synthetic audio generation technology developers
Deployers
- North Korea
- Lazarus Group
- Government of North Korea
- BlueNoroff
Harmed parties
- Zoom
- Web3
- Unnamed Web3 employee
- National security and intelligence stakeholders
- macOS users
- Epistemic integrity
- Cryptocurrency infrastructure
Tags
- espionage
Classification
Category confidence: 95%
Severity confidence: 90%
Rationale: AI-generated deepfake videos were used to deceive an employee into installing malware, causing financial and security harm.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8