BlueNoroff, a North Korean state-sponsored group targeting cryptocurrency firms for regime revenue, has escalated its attack tradecraft by combining AI-generated deepfake avatars with stolen victim video footage to impersonate trusted contacts in fraudulent Zoom meetings. Targeted cryptocurrency executives are tricked into executing malicious commands through a technique called ClickFix, resulting in macOS compromise. Organizations in the crypto sector face direct risk of significant financial theft and secondary reputational harm as compromised personnel are recycled as lures against their own networks and peers.