NORTH KOREAN CRYPTOCURRENCY THIEVES CAUGHT HIJACKING ‘REMOTE CONTROL' FEATURE

Summary from the TLDR InfoSec newsletter

The non-profit Security Alliance (SEAL) and Trail of Bits have both released advisories regarding a North Korean social engineering campaign that involves masquerading as VC investors. The threat actors send victims a Calendly link to schedule a Zoom call with a PR pitch to appear on a podcast run by Aureon Capital. If a victim accepts the meeting, the attackers ask the victim to share their screen to present their work and at some point will request ‘Remote Control' while changing their display name to Zoom to make the notification mimic a system notification. The attackers use this access to deploy either infostealers or full RATs.