BlueNoroff is using fake Zoom meetings, deepfake participant media, and ClickFix clipboard injection to target cryptocurrency and Web3 executives. The attack starts with Calendly-based social engineering and typo-squatted meeting domains, then tricks victims into running an obfuscated PowerShell payload that establishes C2, persistence, credential theft, Telegram session theft, screenshot capture, and UAC bypass. The campaign reportedly reuses stolen webcam footage and AI-generated media to make future lures more convincing, with more than 100 victim identities and over 950 media files recovered from attacker infrastructure. Confirmed targeting is heavily concentrated on crypto founders, executives, and financially adjacent leadership roles.