BlueNoroff, a DPRK-controlled financial threat cluster also tracked as Sapphire Sleet, compromises cryptocurrency executives through fake Zoom and Microsoft Teams meetings. Operators cultivate trusted contacts, reproduce legitimate meeting interfaces, capture webcam footage, fingerprint browser wallets, and induce victims to run malicious troubleshooting instructions. Stolen Telegram sessions and video are reused to approach additional targets, while delayed follow-on activity helps conceal the intrusion. Microsoft estimated that the cluster stole more than $10 million from multiple companies during a six-month period in 2024.