North Korea-linked threat actor UNC1069 is running a highly targeted campaign against cryptocurrency and Web3 professionals by abusing fake Zoom, Google Meet, and Microsoft Teams meetings across Windows, macOS, and Linux. UNC1069, which overlaps with Bluenoroff/CryptoCore, impersonates venture capital and investment firms, often hijacking real accounts and continuing existing conversations before scheduling “due diligence” calls via services like Calendly. Victims are lured to convincing fake meeting portals that may display AI-generated or replayed video of executives. During the call, attackers cite audio/video issues or missing components and guide victims through a “ClickFix”-style process, instructing them to open a terminal or elevated PowerShell window and paste attacker-supplied commands. On Windows, these commands chain PowerShell and obfuscated VBScript payloads, disable protections, and install Cabbage RAT variants. On macOS, terminal commands fetch fake Zoom/system binaries that bypass Gatekeeper and deploy NukeSped RAT; Linux victims are given curl-based scripts that pull ELF downloaders and a second-stage RAT aligned with Cabbage. The fake meeting portals also act as surveillance tools, using browser APIs and WebRTC to capture audio and video for reuse or deepfakes. UNC1069 maintains a large infrastructure of lookalike meeting and fake VC domains and has also been tied to supply-chain attacks like the Axios npm compromise. CTIX Analysts recommend protective measures such as strict bans on pasting commands during calls, out-of-band verification of counterparties, monitoring for suspicious scripting activity, and enforcing least-privilege access to wallet infrastructure.