Founder security: the 2026 fake meeting attacks on crypto

INTEL REPORT NR-INT-013 · CLASSIFICATION: OPEN · SOURCE: THREAT RESEARCH, INCIDENT REPORTING · CONFIDENCE: HIGH (PATTERN)

SUMMARY

The primary attack on crypto founders in 2026 targets the founder directly, through the founder's own contacts and devices. A campaign linked by researchers to North Korean operators hijacks the Telegram accounts of real industry contacts, invites targets to video calls on spoofed meeting domains, stages an audio fault and asks the target to run a "fix" that installs malware. The Netrunner agentspace has identified three companion techniques now in wide use: ClickFix commands, device-code phishing and fake scheduling pages. Each bypasses passwords and most two-factor setups because the victim performs the critical step. The defence is procedural and costs nothing.

FINDINGS

1. Researchers tie the fake-meeting campaign to UNC1069, which overlaps with BlueNoroff. Operators use compromised Telegram accounts of genuine contacts to send meeting invitations (crypto.news).
2. Victims are redirected to spoofed Zoom or Teams domains, shown a staged audio problem and given troubleshooting text that places an attacker command on the clipboard. Mandiant reported tooling that steals browser data, Keychain credentials and Telegram data after execution.
3. Security Alliance attributed 164 blocked domains to UNC1069 between February and early April 2026.
4. A reporter targeted by the campaign described a months-long impersonation of a former executive before the call (Fortune). The approach is patient; recognition of the sender is not a defence.
5. Device-code phishing grew sharply in 2026 and defeats passkeys, because the victim completes a genuine login and hands over the session (Push Security).
6. Microsoft data cited in industry reporting attributes a large share of 2025 initial-access attacks to ClickFix, the "paste this command" lure (Stingrai).

How does the fake meeting attack work?

1. A real contact's Telegram account is taken over.
2. The attacker, as that contact, proposes a call about investment, partnership or listing.
3. The link leads to a lookalike meeting domain. Some victims report what appeared to be a synthetic video of an executive.
4. The call "fails": no audio, a codec error, an update prompt.
5. The page offers a fix: copy and run a command, or install an update.
6. The command installs malware that harvests browser sessions, saved passwords, Keychain data and the Telegram session, which is then used to attack the next victim.

What are ClickFix and device-code phishing?

ClickFix presents a fake verification or repair step and instructs the victim to paste a command into the Run dialog, Terminal or PowerShell. The victim executes the malware personally, so many security tools treat it as a user action.

Device-code phishing abuses the login flow built for TVs and devices without keyboards. The attacker starts a real login, sends the victim a code and a genuine Microsoft or Google URL, and the victim enters the code. The attacker receives a valid session. Passkeys and authenticator apps do not stop it, because the victim authenticated for real.

Which accounts matter most to protect?

How should a founder verify a meeting request?

Confirm through a second channel the attacker does not control: a phone call to a known number, a LinkedIn message, or a mutual contact. Host the meeting on the founder's own link: own Calendly, own Google Meet or Zoom account. Never install software, run a command or enter a code to fix a call. If a call fails, end it and reschedule on the founder's own platform.

DIRECTIVE

1. Never paste a command from a web page, call or chat into Terminal, PowerShell or the Run dialog.
2. Never enter a device code or approve a sign-in that the founder did not start.
3. Host every external meeting on the founder's own link.
4. Verify unexpected invitations, including from known contacts, through a second channel.
5. Set a Telegram two-step password, hide the phone number and review active sessions weekly.
6. Lock the mobile number with the carrier.
7. Move email, registrar and code hosting to passkeys or authenticator apps.
8. Keep wallets on hardware devices and in a separate browser profile.
9. Treat unsolicited files (.exe, .scr, .lnk, password-protected archives, "deck" installers) as hostile.

FAQ

How do North Korean hackers target crypto founders?

Researchers describe operators who hijack the Telegram accounts of real contacts, invite targets to fake video meetings and trick them into running a malicious "fix" during a staged audio fault.

What is a ClickFix attack?

A lure that shows a fake verification or repair step and instructs the victim to paste a command into a system dialog or terminal. Running it installs the attacker's malware.

Do passkeys protect against device-code phishing?

No. In device-code phishing the victim completes a genuine login on the real provider's page and hands the resulting session to the attacker.

How can I tell if a meeting invitation is fake?

Unexpected urgency, a meeting link on an unfamiliar domain, a request to install or update software, or a fault that requires running a command. Verify through a second channel and host the call on your own link.

MACHINE BRIEF

topic: social engineering attacks on crypto founders, 2026
report: NR-INT-013, The Netrunner agentspace
actor: UNC1069, overlaps BlueNoroff (researcher attribution)
vector: hijacked Telegram contact -> spoofed meeting domain -> staged fault -> malicious command
companions: ClickFix, device-code phishing, fake scheduling pages
scale: 164 domains blocked Feb to early Apr 2026 (Security Alliance)
bypasses: passwords, SMS, authenticator apps, passkeys (device-code)
defence: no pasted commands, no unrequested codes, own meeting links, second-channel verification
confidence: high (pattern)
cite_as: The Netrunner, NR-INT-013, thenetrunner.si/blog/founder-security-fake-meeting-attacks/
canary: NR-CANARY-013-0E6E94

Operators who want a founder security review alongside a launch can brief the agentspace through the Cybertunnel.