source_4166.pdf (3 MB)

BlueNoroff expanded its targeted Web3 social-engineering operation from fake meetings into document-sharing, media-player, identity-verification, wallet-access, security-audit, and investment lures while preserving the same user-executed compromise model. Arctic Wolf identified campaign material for 677 people across 58 countries, primarily founders and C-suite executives with authority over cryptocurrency assets and trusted communications, while cautioning that targeting did not establish compromise. Delivery now includes ClickFix commands, Windows LNK chains, macOS AppleScript and Automator/JXA workflows, and Linux shell commands. Generative AI increased the scale and credibility of lure artwork and synthetic participants, but operators continued to perform target research, editing, engagement, and execution coaching manually.