Case kaspersky-bluenoroff-ghostcallState actor AI opsWorldwide
Kaspersky: BlueNoroff GhostCall and GhostHire campaigns sped up by generative AI
Kaspersky said BlueNoroff used generative AI to speed malware development and analyse stolen data for targeting in GhostCall (fake VC calls on macOS) and GhostHire (fake recruiter tests), active since April 2025.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 28, 2025
- Location
- Worldwide
- Target
- Web3 and crypto executives and blockchain developers
- Severity
- High
- Triggered by
- BlueNoroff (Lazarus subgroup)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Kaspersky said BlueNoroff used generative AI to speed malware development and analyse stolen data for targeting in GhostCall (fake VC calls on macOS) and GhostHire (fake recruiter tests), active since April 2025.
Impact: Executives and developers compromised across several countries; stolen data reused for supply-chain style follow-on attacks.
Who triggered it
Actor: BlueNoroff (Lazarus subgroup)
Attribution: Kaspersky GReAT attributes both campaigns to BlueNoroff under the Lazarus umbrella; shared C2 and tooling.
Motive: Cryptocurrency theft for the DPRK
How it happened
Attack vector: Telegram approaches from fake or hijacked VC accounts, fake Zoom and Teams update pages, malicious GitHub skill-test repos; seven multi-stage chains delivering crypto and credential stealers
Root cause: AI-accelerated tooling and replayed victim videos made social engineering and malware iteration faster and more convincing
Timeline
- GhostCall and GhostHire activity observed from at least this month
- Kaspersky presents findings at Security Analyst Summit
Response
Kaspersky published indicators and detection guidance for macOS and Windows chains.
Current status: Ongoing
Sources (open in a new tab)
- Kaspersky kaspersky.com
- eSecurity Planet esecurityplanet.com
Cite this case
Kaspersky: BlueNoroff GhostCall and GhostHire campaigns sped up by generative AI. AI Threat Watch, case kaspersky-bluenoroff-ghostcall, Oct 28, 2025. https://aithreat.io/cases/kaspersky-bluenoroff-ghostcall/
Permanent link: https://aithreat.io/cases/kaspersky-bluenoroff-ghostcall/