![\"\"](\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/cryptoslate-icon.jpg\"){kind=icon}
CryptoSlate<\/span> <\/span> preferred on<\/span> ![\"\"](\"https:\/\/cryptoslate.com\/wp-content\/themes\/cryptoslate-2020\/images\/google-logo.svg\"){kind=logo}
<\/div>\nA crypto founder had his laptop compromised when he joined what appeared to be a Microsoft Teams call with Pierre Kaklamanos, a Cardano Foundation contact he had spoken with before.<\/p>\n
When \u201cPierre\u201d reached out about Atrium and sent a Teams invite, nothing looked out of place. On the call, the face and voice matched what he remembered, and two other apparent foundation members were present.<\/p>\n
When the call lagged and dropped him, a prompt told him his Teams software was out of date and needed reinstalling through Terminal. He ran the command, then shut the laptop off because the battery was dying, which limited the damage in retrospect.<\/p>\n
He describes himself as \u201cquite technically savvy,\u201d which is part of the point that the attack worked because the context felt legitimate.<\/p>\n
Social engineers have always relied on familiarity, and executing that at scale once required either a compromised account or weeks of text-based rapport-building.<\/p>\n
The video call was the authentication layer, the thing victims learned to trust, and replicating it is now within reach.<\/p>\n
Fake update<\/h2>\n
Microsoft documented campaigns in February and March 2026 in which malicious files masqueraded as workplace apps, such as msteams.exe and zoomworkspace.clientsetup.exe, with phishing lures that mimicked legitimate Teams and Zoom meeting workflows.<\/p>\n
In a separate warning, Microsoft described \u201cClickFix\u201d-style prompts targeting macOS users, instructing them to paste commands into Terminal and targeting browser passwords, crypto wallets, cloud credentials, and developer keys.<\/p>\n
The fake Teams update fits both patterns simultaneously.<\/p>\n
Google Cloud’s Mandiant unit described a crypto-focused intrusion built on the same structure. A compromised Telegram account, a spoofed Zoom meeting, what witnesses described as a deepfake-style executive video, and troubleshooting commands that launched the infection.<\/p>\n
Mandiant said it could not independently verify which AI model, if any, generated the video, but confirmed the group used fake meetings and AI tools during social engineering.<\/p>\n
On Apr. 24, the real Pierre Kaklamanos posted on X saying his Telegram had been hacked and that someone was impersonating him, along with \u201ca few other people in the industry this week.\u201d<\/p>\n
He told followers to avoid clicking links or booking meetings through the account and to verify contact through LinkedIn direct messages.<\/p>\n
By then, the founder had already messaged the account suggesting they switch to Google Meet. Whoever controlled Pierre’s Telegram account replied that he had gotten busy and asked to reschedule, with the attacker still managing the persona once the call ended.<\/p>\n
That exchange turns the incident from an isolated embarrassment into a live campaign signal that the method is active, the account compromise is the entry point, and the relationship history is the weapon.<\/p>\n
| Stage<\/th>\n | What the victim saw<\/th>\n | Why it looked legitimate<\/th>\n | What the attacker was likely trying to achieve<\/th>\n<\/tr>\n<\/thead>\n | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Initial outreach<\/td>\n | \u201cPierre\u201d reached out about Atrium and suggested a call<\/td>\n | The victim had spoken with Pierre before, including on video<\/td>\n | Reopen an existing trust relationship instead of starting from a cold approach<\/td>\n<\/tr>\n | ||||||||||||||||||||
| Meeting setup<\/td>\n | A Microsoft Teams invite for the next day<\/td>\n | Teams is a normal business workflow and the topic was plausible<\/td>\n | Move the target into a controlled environment that felt routine<\/td>\n<\/tr>\n | ||||||||||||||||||||
| Live call<\/td>\n | Familiar face, familiar voice, plus two other apparent Cardano Foundation members<\/td>\n | The social context matched the victim\u2019s memory of prior interactions<\/td>\n | Lower suspicion and make the call itself feel like verification<\/td>\n<\/tr>\n | ||||||||||||||||||||
| Call disruption<\/td>\n | Lagging, instability, then getting kicked out<\/td>\n | Technical glitches are common in video calls<\/td>\n | Create frustration and set up the fake \u201cfix\u201d as a normal troubleshooting step<\/td>\n<\/tr>\n | ||||||||||||||||||||
| Fake update prompt<\/td>\n | A message saying Teams was out of date and needed reinstalling through Terminal<\/td>\n | Software update prompts are familiar, and the user rarely used Teams<\/td>\n | Get the victim to execute a malicious command directly<\/td>\n<\/tr>\n | ||||||||||||||||||||
| Command execution<\/td>\n | The victim ran the command, then shut down the laptop because the battery was dying<\/td>\n | The workflow still felt like a routine app fix at that moment<\/td>\n | Launch the infection chain and gain access to credentials or device data<\/td>\n<\/tr>\n | ||||||||||||||||||||
| Post-call follow-up<\/td>\n | The victim suggested switching to Google Meet; the attacker said he got busy and asked to reschedule<\/td>\n | The persona continued behaving like a real contact after the failed attempt<\/td>\n | Keep the relationship alive for another attempt and avoid immediate suspicion<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\nWhy generative media changes the threat surface<\/h2>\nThe founder said he now believes the call may have involved AI-generated or manipulated video. Forensic confirmation of the tools is lacking, and the OpenAI connection here is governed by its own safety documentation.<\/p>\n OpenAI launched its 4o image generation model on Mar. 25, describing it as capable of \u201cprecise, accurate, photorealistic outputs,\u201d and released the ChatGPT Images 2.0 System Card on Apr. 21.<\/p>\n The firm stated that the model’s \u201cheightened realism\u201d could, absent safeguards, enable more convincing deepfakes of real people, places, or events. One of the leading AI labs has now put on record that its own image model raises the ceiling on what a convincing fake can look like.<\/p>\n The World Economic Forum said in January 2026 that generative AI lowers the barrier to phishing while raising its credibility, through realistic deepfake audio and video that can evade both detection systems and human scrutiny.<\/p>\n INTERPOL declared financial fraud one of the world’s most severe and rapidly evolving transnational crimes in March 2026, identifying deepfake videos, audio, and chatbots as tools that make impersonation of trusted people easier to carry out at scale.<\/p>\n \n \n CryptoSlate Daily Brief<\/span><\/p>\n Daily signals, zero noise.<\/h3>\n 5-minute digest<\/span> 100k+ readers<\/span><\/p>\n<\/div>\n Whoops, looks like there was a problem. Please try again.<\/span><\/p>\n You\u2019re subscribed. Welcome aboard.<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n Chainalysis estimated that crypto scams and fraud reached $17 billion in 2025, with impersonation scams up 1,400% year over year and AI-enabled scams generating 4.5 times as much revenue as traditional methods.<\/p>\n Crypto attracts this class of attack because it combines high-value targets, fast settlement rails, and an informal communications culture in which Telegram introductions and ad hoc video calls between founders are routine.<\/p>\n Mandiant documented that the group behind the crypto Zoom intrusion targeted software firms, developers, venture firms, and executives across payments, brokerage, staking, and wallet infrastructure.<\/p>\n Mandiant noted that the victim’s data could be used to seed future social engineering, with each compromise generating material for the next.<\/p>\n Zoom announced on Apr. 17 a partnership to add real-time human verification to meetings, a \u201cVerified Human\u201d badge, and a \u201cDeep Face Waiting Room,\u201d treating participant authenticity as a product problem.<\/p>\n Gartner predicts that by 2027, 50% of enterprises will invest in disinformation-security products or TrustOps strategies, up from less than 5% today.<\/p>\n In the bull case, that buildout reaches critical mass quickly enough that attackers must defeat multiple independent trust layers to complete a conversion, and the economics of impersonation campaigns deteriorate.<\/p>\n In the bear case, the timeline compresses before defenses do. Gartner warned that AI agents may halve the time required to exploit account takeovers by 2027, narrowing the window for human hesitation or security team intervention.<\/p>\n Deloitte estimated that generative AI-enabled fraud losses in the US alone could climb from roughly $12 billion in 2023 to $40 billion by 2027.<\/p>\n Every public-facing crypto executive becomes both a target and a lure asset, a source of voice recordings, video clips, and relationship graphs that attackers can deploy against the next victim.<\/p>\n Zoom is building liveness checks into meetings, Microsoft is documenting attack chains that impersonate its own software, and the FBI has warned that malicious actors are already using AI-generated voice and text to impersonate trusted contacts, advising against assuming a message is authentic because it appears to come from a known person.<\/p>\n Verification now requires independent rails, such as a known phone number, a hardware key, a shared passphrase established before any meeting, or a pre-agreed internal channel that no attacker has accessed.<\/p>\n<\/div>\n Hacks,Scams#scams #crypto #approach #breaking #point1777231539<\/p>\n","protected":false},"excerpt":{"rendered":" Make CryptoSlate preferred on A crypto founder had his laptop compromised when he joined what appeared to be a Microsoft Teams call with Pierre Kaklamanos, a Cardano Foundation contact he had spoken with before. When \u201cPierre\u201d reached out about Atrium and sent a Teams invite, nothing looked out of place. On the call, the face<\/p>\n","protected":false},"author":1,"featured_media":8666,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[137,311,62,1344,1590],"class_list":{"0":"post-8665","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-ethereum","8":"tag-approach","9":"tag-breaking","10":"tag-crypto","11":"tag-point","12":"tag-scams"},"yoast_head":"\n |
![\"AI](\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/04\/brave_jSCV4txeyk.jpg\")