Bluenoroff phishing kit
Bluenoroff uses fake meeting and invitation pages to collect visitor details and credentials and push Zoom-branded downloads. We have matched it on 10 sites since 11 August.
Bluenoroff in numbers
Since 11 August, the first Bluenoroff match in our records, counted on 13 October 2026. How we count.
| Sites with Bluenoroff code | 10 |
|---|---|
| Sites with a match in the last 30 days | 6 |
| New sites in September | 4 |
| Sites captured since 25 September | 4 |
A North Korean group behind fake meetings
BlueNoroff is the name researchers give a North Korean group that targets cryptocurrency and finance staff with fake Zoom and Teams meetings and fake update prompts. Kaspersky's GhostCall research describes the meeting invitations, the fake update step and the downloads that follow. The pages in our captures are the website side of that operation.
The meeting page reports the visitor
Bluenoroff's fake meeting pages collect an IP address and geolocation, the browser's user agent and the referring page. One pre-join page reads config.php, looks up the visitor through ipwho.is and sends a Telegram message headed Visitor alert:. It then sends the parent window to download.html.
Another meeting page requests camera access and uploads screenshots to /screenshot.php. It submits waiting-room details to /waitingroom.php, polls /poll.php with a session token and sends identity and presence updates through /notify.php and /presence.php. Meeting details come from /data/meetings.json.
Invitation forms collect the email password
A meeting-invite clone sends the email address and password to an endpoint decoded with atob. Its script reads the cid query parameter. After submission, the page reports that the email or password is incorrect and clears the password field for another attempt.
A packed sign-in loader reconstructs the credential page from a numeric array named erp. It splits the stored numbers into characters with Math.pow and String.fromCharCode, then writes the recovered HTML into the document with document.write(em).
Fake Zoom updates start a download
The download lures use a Zoom meeting page, a copied Microsoft Store page for Zoom Workplace or a page titled Zoom Workspace Update. The meeting and Store versions post a download action and meeting ID to process.php. The response supplies downloadUrl; the script fetches that file and turns it into a browser download through a Blob URL.
The Workspace update pages use Dropbox file links. Some ask the visitor to download an executable manually. Retained copies animate update progress, then create a hidden iframe that starts an MSI or ZIP download automatically. The filename and page branding present the file as a Zoom update.
What we see
| Month | New sites |
|---|---|
| September | 4 |
| October so far | 3 |
We have retained successful captures from 4 Bluenoroff sites since 25 September.
Checking a fake meeting page
Record the invitation path, scripts and network requests. Look for:
- a pre-join page that sends visitor IP, location, user agent and referrer to Telegram
- camera access followed by
/screenshot.phpuploads - waiting-room and approval requests tied to a session token
- an email-password form that clears the password after a scripted error
- a numeric
erparray decoded into HTML withdocument.write(em) process.phpreturning a download URL for a meeting ID- a Zoom Workspace update page that creates a hidden Dropbox download iframe
Remove the meeting pages, credential forms, download routes and their configuration. Review hosting, DNS and deployment access and rotate their credentials.