Hunt tracked a suspected North Korean phishing campaign that targeted blockchain and angel investing communities through Telegram. The actor posed as an investment firm representative, built trust with entrepreneurs, arranged a meeting, then used a fake restricted meeting error to persuade victims to run a malicious AppleScript named IP_Request.scpt. The script fetched follow on commands from support.internal-meeting.site, part of an infrastructure cluster using Hostwinds servers, Let's Encrypt certificates, meeting themed domains, and RDP certificate naming patterns. Hunt connected the activity to Lazarus adjacent tradecraft and noted overlaps with Bluenoroff, APT38, and Black Alicanto infrastructure patterns.