Case unc1069-deepfake-zoomDeepfake fraudWorldwide
North Korea's UNC1069 uses AI deepfake video in fake Zoom calls against crypto firms
Mandiant tied a fintech intrusion to DPRK-linked UNC1069, which paired a hijacked Telegram account, a spoofed Zoom meeting with AI-generated video, and ClickFix lures to plant macOS malware.
HighAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Feb 9, 2026
- Location
- Worldwide
- Target
- Fintech and crypto companies
- Severity
- High
- Triggered by
- UNC1069 (North Korea-linked, aka Masan)
- Actor type
- State-sponsored
- Reported loss
- None reported
- CVE
- None
What happened
Mandiant tied a fintech intrusion to DPRK-linked UNC1069, which paired a hijacked Telegram account, a spoofed Zoom meeting with AI-generated video, and ClickFix lures to plant macOS malware.
Impact: Seven macOS malware families on one victim host; credentials, browser data, session tokens, Keychain items, Telegram data and Apple Notes collected. Losses not disclosed.
Who triggered it
Actor: UNC1069 (North Korea-linked, aka Masan)
Attribution: Attributed by Mandiant with high confidence to a DPRK-nexus group tracked since 2018
Motive: Cryptocurrency theft and harvesting identities for future social engineering
How it happened
Attack vector: Compromised executive Telegram account, Calendly link to spoofed Zoom page with AI-generated video of a CEO, ClickFix command installing macOS loaders
Root cause: Trust in known contacts on messaging apps and willingness to run pasted terminal commands to fix a fake meeting issue
Timeline
- GTIG notes UNC1069 using Gemini for wallet-targeting scripts and lures
- Mandiant publishes intrusion analysis with new SILENCELIFT, DEEPBREATH and CHROMEPUSH malware
Response
Mandiant incident response, publication of indicators and hardening guidance on unsigned script execution.
Current status: Ongoing
Sources (open in a new tab)
- The Record therecord.media
- BleepingComputer bleepingcomputer.com
- SOC Prime socprime.com
Cite this case
North Korea's UNC1069 uses AI deepfake video in fake Zoom calls against crypto firms. AI Threat Watch, case unc1069-deepfake-zoom, Feb 9, 2026. https://aithreat.io/cases/unc1069-deepfake-zoom/
Permanent link: https://aithreat.io/cases/unc1069-deepfake-zoom/