Huntabil.IT describes an April 2025 incident response case that exposed a likely North Korea directed campaign against Web3 and crypto organizations. The operators impersonated a trusted Telegram contact, pushed the target through Calendly to a fake Zoom SDK update, and delivered AppleScript from a typosquatted support.us05web-zoom domain tailored for macOS victims. The script called C2 with host and process details, dropped Mach-O persistence components under ~/Library/DnsService, and pulled data theft scripts that collected browser, shell, and Telegram data. Huntabil.IT assessed the activity as targeted reconnaissance and initial data theft aimed at people involved in treasury operations, with infrastructure appearing shortly before the attack.