BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
2026-07-25T07:24:13Z•9d99818453afaaf1005ff7062a9c39b2fbfbffb0eacfd00b4488e8c32f0bffbe
AI-agentsActive DirectoryBlueNoroffChaos-ransomwareDCSyncGitHub-ActionsGolden-ChickensKerberosNodeBBRedisTriBack-LoaderUAC-0099Zimbraactive-exploitationcredential-theftmalwarephishingprivilege-escalationransomwareremote-code-executionsandbox-escapestate-sponsoredsupply-chaintyposquattingzero-day
What happened
A large set of active and recently disclosed threats and vulnerabilities: North Korean BlueNoroff is running a Zoom/Microsoft Teams typosquatting phishing kit that profiles crypto wallets prior to malware delivery; a new AD exploit dubbed "Certighost" lets low-privilege users obtain a Domain Controller certificate and potentially perform DCSync; multiple AI/agent security failures (AgentForger, Claude Cowork, Hermes) enable stealthy agent deployment, sandbox escapes, or unattended post-exploitation; crafted SVGs in Bing Images led to SYSTEM/root execution (Microsoft issued critical CVE(s)); a枚
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 9d99818453afaaf1005ff7062a9c39b2fbfbffb0eacfd00b4488e8c32f0bffbe
- Enrichment time
- 2026-07-25T07:24:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.