JustJoin is a deceptive landing-page and infrastructure cluster that impersonated a macOS application for monitoring Zoom meetings and was linked to suspected DPRK activity. Shared server fingerprints, hosting patterns, SSH keys, and themes resembling virtual-meeting services connected the cluster to infrastructure tradecraft associated with TA444, also known as BlueNoroff, though the attribution remained assessed rather than definitive. The same cluster later overlapped with command infrastructure used in a targeted, trojanized software-supply-chain intrusion that delivered a cross-platform remote-access tool to developer environments.