SEAL attributed 164 blocked domains observed from February to April 2026 to DPRK-nexus UNC1069, also described as BlueNoroff, in campaigns targeting cryptocurrency and Web3 users. The actor conducts patient social engineering over Telegram, LinkedIn, and Slack, often from compromised trusted accounts, then lures victims into fake browser-based Microsoft Teams or Zoom meetings. The infection flow uses audio-problem prompts to push an AppleScript download or terminal copy-paste command, after which an implant assigns a UUID, establishes persistence, beacons roughly every 60 seconds, and receives operator tasking. Reported post-compromise modules include credential theft, keylogging, session token harvesting, browser extension replacement, and exfiltration of crypto wallets, password managers, Telegram sessions, SSH keys, and cloud credentials. The advisory also warns that the actor’s willingness to weaponize npm and open-source supply-chain access expands risk beyond direct crypto executives to maintainers and developer communities.