Fake Teams and Zoom domains SEAL links to North Korea's UNC1069, plus a Contagious Interview domain (Oct 2026): 12 domains
- Scam type: Phishing
- Project or site name: Fake Microsoft Teams / Zoom meeting domains (SEAL: DPRK UNC1069, Contagious Interview)
- Incident date: 2026-10-27
- Reported: 2026-10-27
- Last updated: 2026-10-27
Security Alliance (SEAL) reported on 2026-10-27 three incidents in its 20-27 October week that it classes as North Korea (DPRK) intrusions, with $3.22M lost. SEAL attributes the largest, about $3.19M taken after a wallet browser extension was replaced, to the group it calls UNC1069, and links two fake job-interview losses of about $34.8K in total to the Contagious Interview campaign. Fake Teams and Zoom domains SEAL attributes to UNC1069: tearnrnicrocoft[.]com teernsrniceroseft[.]com us02live[.]co us06cloud[.]live Domain SEAL links to Contagious Interview: zenzyvera[.]store Domains SEAL lists…
Websites in this report: tearnrnicrocoft.com, teernsrniceroseft.com, us02live.co, us06cloud.live, tearns.online, us04.live, us05meet.cloud, us05meet.live, us06.live, us06cloud.com, us06live.online