The Interview Was the Attack: Crypto Spear-Phishing in 2026

In April 2025, Jake Gallen did something he had done many times before: he accepted an interview. The request came from a verified X account with roughly 26,000 followers, whose owner claimed to be the founder of a crypto company and invited Gallen, the chief executive of the NFT platform Emblem Vault, to an interview. The conversation moved to Zoom. By the time it ended, a program called GOOPDATE was running on his computer, it had harvested his credentials and reached into his wallets, and more than $100,000 in Bitcoin and Ether was gone, according to Cointelegraph.

There was no malicious attachment. No fake login page. No shady link to misread. The booking looked real in every way a busy executive bothers to check, right up to the moment the attacker asked to control his screen. The meeting was the attack.

This is what a growing share of crypto phishing looks like in 2026. The high-volume wallet-drainer campaigns that defined 2023 and 2024, the ones that blasted fake-airdrop links at hundreds of thousands of wallets, have collapsed. On-chain drainer losses tracked by the security firm Scam Sniffer fell 83% in 2025, to about $83.85 million from roughly $494 million the year before. What replaced the mass net is quieter and far more surgical: a handful of carefully chosen people, founders, developers, treasury signers, and large holders, approached inside a trusted professional context and worked by a live human operator or, increasingly, an AI-generated face.

The macro backdrop sharpens the incentive. Bitcoin changed hands near $82,500 on 20 October, with the total crypto market valued around $2.89 trillion, per CoinGecko, well below the record set a year earlier even as prices traded nervously through the autumn. A drawdown does not shrink the prize. Exchange treasuries, protocol multisigs, and private whales still sit on fortunes, and the people with access to them are a small, nameable population. That is exactly the population these campaigns hunt.

The pretext is the payload

Classic phishing has a shape security tools are built to catch. You receive a message, you follow a link, you land on a counterfeit page or a malicious transaction, and you hand over a password or a signature. Every defense in the stack assumes the attack will surface somewhere a filter can see it: in an inbox, in a URL reputation list, in a wallet simulation that previews what a transaction will do.

Targeted social-engineering campaigns remove the suspicious link entirely. The lure is not a fake page; it is a legitimate-seeming situation. A podcast booking. A job interview. A venture-capital meeting. A support ticket. The victim is doing something ordinary and professional, often something they do every week, and the hostile act is folded into a normal step of that interaction: share your screen, run this to fix the audio, clone this repository, confirm your recovery backup. The payload is the pretext.

That is why these operations slip past controls that work well against mass phishing. A conversation on Zoom is not an email a gateway can quarantine. A code repository handed over in a job interview is not a known-bad domain. A request to enable a built-in remote-control feature is not a malware download. The attacker is not breaking the software; the attacker is borrowing a workflow the victim already trusts.

Researchers increasingly treat these as deliberate, resourced operations rather than opportunistic spam. The Security Alliance, an industry nonprofit that runs incident response for crypto teams and goes by SEAL, describes one such actor as a persistent campaign that has been responsible for millions of dollars in stolen funds. The economics explain the behavior. Chainalysis found that impersonation scams grew more than 1,400% year over year and that AI-enabled scams were roughly 4.5 times more profitable than traditional ones, as criminals shifted away from spray-and-pray cons toward fewer but much richer targets.

Two speeds of phishing, and why the nets got smaller

The headline numbers look, at first glance, like good news. Scam Sniffer, which tracks on-chain wallet-drainer phishing, counted $83.85 million stolen from 106,106 victims in 2025, down 83% in value and 68% in victims from the roughly $494 million and 332,000 victims of 2024. The drainer-kit economy that industrialized signature theft has been squeezed by better wallet warnings, transaction simulation, and law-enforcement pressure.

Look closer and the picture inverts. In January 2026, signature-phishing losses jumped to $6.27 million from about 4,700 wallets, a 207% rise over December, even as the number of victims fell 11%. Two victims accounted for 65% of the month’s losses. The same month produced the single largest individual crypto theft of the year, a $282 million heist in which one person was talked into surrendering a hardware-wallet recovery backup to someone posing as wallet support. Fewer people are being robbed, and far more money is leaving per person.

That divergence is the whole story. The cheap, broad lane shrank because the defenses against it got good and the margins got thin. The expensive, narrow lane grew because the people worth targeting, and the sums they control, justify a bespoke operation: weeks of reconnaissance, a convincing front brand, a live operator, sometimes a synthetic face. When whales and treasuries hold a large share of a market still measured in trillions, one successful spear beats ten thousand nets.

Anatomy of ELUSIVE COMET

The campaign that hit Jake Gallen is tracked by SEAL under the name ELUSIVE COMET, and its tradecraft is a useful template for the whole category. According to the group’s advisory, the actor operates a cluster of fake brands built to look like a media and investment ecosystem: a purported venture firm called Aureon Capital, a companion outlet called Aureon Press, and a show called The OnChain Podcast. A target who does basic due diligence finds a website, a social presence, and a plausible reason to take the call.

Outreach starts over X direct messages or email with an invitation to appear as a guest. The attackers schedule a Zoom call and sometimes withhold the meeting details until the last minute to manufacture a little urgency. On the call, the victim is prompted to share their screen. Then the operator uses Zoom’s own feature to request remote control of the victim’s computer. The twist that makes it work, documented by Help Net Security, is that the attacker renames their Zoom display name to Zoom, so the permission prompt reads like a routine system message: Zoom is requesting remote control of your screen. A distracted guest clicks approve, and the attacker is now typing on their machine, installing an infostealer or a remote-access trojan.

Gallen later detailed how ordinary the setup felt and where the trap was hidden. “For this scam to take place, it’s said that the guest of the Zoom video call allows remote access to the host of the call, which is a requestable feature that is DEFAULT ON for every Zoom account,” he wrote after the compromise, noting the loss came to “$100k+ in purchased digital assets.” The malware, dubbed GOOPDATE, did the rest. The lesson he drew in public was blunt: the dangerous permission was on by default, and almost nobody had turned it off.

When the caller is a deepfake

If ELUSIVE COMET shows the pretext at its most human, a campaign Mandiant disclosed in February 2026 shows where it is heading. Mandiant, part of Google Cloud, attributes the operation to UNC1069, a financially motivated North Korean group, and describes a multi-stage intrusion assembled entirely out of trusted-looking interactions.

It began with a compromised Telegram account belonging to a crypto executive the victim already knew, which was used to send a Calendly link to a Zoom meeting hosted on attacker infrastructure. On the call, as reported by The Record, the victim was shown what appeared to be an AI-generated deepfake of a chief executive from another crypto company. The script then pivoted to a classic ClickFix routine: the victim was told their audio was broken and asked to run a few troubleshooting commands. Those commands installed the WAVESHAPER and HYPERCALL backdoors along with the DEEPBREATH and CHROMEPUSH stealers on the victim’s macOS device, which went on to harvest credentials, browser data, Telegram sessions, and keystrokes.

Mandiant tied seven new malware families to the group and said UNC1069 had used Google’s own Gemini model for operational research and tooling, a candid admission from the vendor whose cloud hosts it. The firm also said it could not independently verify that the on-call video was AI-generated, a caution worth preserving: in this specific case the deepfake is reported, not proven. Even so, the direction is clear, and the defensive problem it creates is severe. If the face on a call can be fabricated in real time, then seeing a familiar colleague is no longer evidence you are talking to them. The question of how you prove the human on the other end is who they claim to be moves from an onboarding problem to a daily one.

The fake recruiter and the poisoned coding test

The interview pretext has a second, prolific form aimed not at executives but at engineers. Palo Alto Networks’ Unit 42 tracks it as Contagious Interview; ESET calls the broader activity DeceptiveDevelopment. The operators pose as recruiters on job platforms, approach developers (especially in crypto and Web3), and invite them to an online interview. Somewhere in the process comes a coding test, a take-home assignment, or a request to debug a repository. Running that code drops a family of infostealers and remote-access tools with names now familiar to responders: BeaverTail, InvisibleFerret, and OtterCookie.

The campaign has grown more professional over time. Researchers have documented operators spinning up fake front companies to lend the recruiting pitch legitimacy, and the lures have folded in ClickFix steps and AI face-swapping during the live video portion of interviews, so the interviewer looks like a real person on camera. The targeting is cross-platform, hitting Windows, Linux, and macOS, because a developer’s machine is valuable regardless of operating system.

The reason this works so well is structural. A developer’s laptop is rarely just a personal device; it holds signing keys, cloud credentials, repository access, and session tokens. Compromise one engineer and you may hold a door into the protocol or company behind them. That is the mechanism behind several of the year’s largest protocol losses, where attackers social-engineered a contributor and then used the stolen credentials rather than any smart-contract bug; the 2026 wave of restaking and bridge incidents repeatedly traced back to a person, not a line of code. It is worth stressing that this is the mirror image of the North Korean IT-worker problem: there, operatives get hired; here, they pose as the employer to infect the people applying.

Andrew Fierman, head of national security intelligence at Chainalysis, has described why artificial intelligence makes this lane so dangerous. AI, he told The Block, “could assist DPRK hackers by crafting more convincing personas for identity-based infiltration and by automating the laundering process to make it both more complex and rapid.” Convincing personas are the entire game when the attack is a conversation.

ClickFix: the paste-this-to-continue trap

Running through several of these campaigns is a single technique worth understanding on its own, because it is spreading fast and it defeats a lot of instinctive defenses. Security teams call it ClickFix. The victim meets a fabricated obstacle, a fake CAPTCHA, a bogus verification step, a claim that a document will not load or that the meeting audio is broken, and the proposed fix is to copy a short command and paste it into Terminal, PowerShell, or the Windows Run box.

The elegance, from the attacker’s side, is that the victim installs the malware with their own hands. There is no attachment to scan, no executable pulled from a flagged domain, no link to a known-bad site. The malicious step is laundered through a legitimate system tool and through the victim’s own typing, which is why it works across operating systems and why it sails past email gateways and URL blocklists. Unit 42’s reporting shows ClickFix stitched directly into fake-interview flows, and the UNC1069 deepfake call used the same beat: a staged audio problem, a helpful instruction, a pasted line that was in fact the payload.

The defensive takeaway is easy to state and hard to hold onto under social pressure: a legitimate service will never ask you to paste a command into a terminal to join a call, prove you are human, or fix your microphone. Treat any such request as hostile, full stop.

Phishing the help desk, in both directions

Support impersonation is the oldest pretext in the book, and in 2026 it runs both ways. The inbound version aims the con at the user. The $282 million January heist began when the victim believed they were talking to hardware-wallet support and handed over a recovery backup; the attacker needed no exploit once the seed was surrendered. Fake-support outreach proliferates after every data breach, and it is not always digital: scammers have mailed physical letters on wallet-vendor letterhead instructing owners to re-enter their 24-word seed on a lookalike portal to apply a bogus firmware or security update.

The outbound version aims the con at the company’s own people. In May 2025, Coinbase disclosed that criminals had bribed overseas support contractors to exfiltrate data on roughly 70,000 customers, including names, contact details, and partial identifiers. Coinbase refused a $20 million ransom and estimated remediation at $180 million to $400 million. The stolen records were not the end goal so much as raw material: a curated list of real customers, with real balances and real contact details, is precisely the targeting data that makes the next round of impersonation calls land.

That is the uncomfortable throughline. The human perimeter, support agents, contractors, community moderators, and junior staff, is now part of the attack surface, and the market value of a breach is often the quality of the target list it produces rather than the data itself.

Why hardware wallets and clear signing do not save you here

The crypto industry has spent two years hardening the parts of the stack that earlier phishing abused, and that work is genuinely valuable. It simply addresses a different failure than the one these campaigns exploit.

Clear signing is the headline fix for malicious transactions. The standard, ERC-7730, turns an opaque signing request into human-readable terms so a user is not blind-approving a payload they cannot parse; the Ethereum Foundation took stewardship of the registry in May 2026, with Ledger, Trezor, MetaMask, and others contributing. It is a strong answer to the question of what you are signing. But a fake-interview campaign never asks you to sign anything. If you grant remote control, run a pasted command, or type your seed into a support portal, the attacker operates as you or lifts the key directly. There is no transaction to make legible.

Hardware wallets isolate private keys from an infected host, which matters. Yet an infostealer on the same computer can still scrape browser-session cookies, exchange logins, and any hot-wallet material, and a user who has been duped can be walked through approving a malicious action on the device itself. Transaction simulation and domain blocklists from vendors such as Blockaid and Scam Sniffer evaluate a proposed transaction against a known site; a Zoom call and a code repository offer neither a transaction nor a domain to judge.

The common thread is that the exploit targets the human and the tools they already trust, not the cryptography. It is the same lesson the industry absorbed from a year in which stolen keys and compromised devices, not contract bugs, drove most large losses: you can audit the code to perfection and still lose everything through the person holding the keys.

The malware behind the handshake

Once the social step succeeds, what lands is usually mundane commodity malware doing a specialized job. The infostealers favored in these campaigns, GOOPDATE in the ELUSIVE COMET case, BeaverTail and OtterCookie in the fake-recruiter flows, CHROMEPUSH and DEEPBREATH in the UNC1069 intrusion, are built to find crypto. They scan disks, clipboards, and screenshots for strings that match the 2,048-word BIP-39 seed list, raid browser password and cookie vaults to resurrect logged-in exchange sessions, read Telegram and Discord tokens, and log keystrokes.

Behind the tooling is a division of labor that looks like a supply chain. One set of operators runs the social engineering and secures initial access. The stolen material, what criminals call logs, is sorted and sometimes resold. Specialist crews handle the cashing-out and the laundering. The video call that opens the whole sequence is only the first link; by the time the money moves, several hands have touched it. That industrialization is also why the same lures recur with small variations across months and continents: the playbook is a product, not a one-off.

Follow the money: attribution is not recovery

A large share of the most sophisticated targeted operations trace to North Korea, and the sums are now macro-relevant. Chainalysis estimated that DPRK-linked actors stole a record roughly $2 billion of crypto in 2025, the largest single-year national haul it has measured. The same campaigns that begin with a fake interview end here, in the laundering pipeline.

The money trail after a successful call is now familiar to analysts: rapid dispersal across fresh wallets, swaps through mixers and cross-chain bridges, and consolidation by Chinese-language laundering networks that move tens of billions of dollars a year. Attribution has gotten remarkably fast and public, with Mandiant, Chainalysis, and SEAL routinely naming the responsible cluster within days. Naming it, though, is not the same as returning the funds. The record $15 billion Bitcoin forfeiture that U.S. authorities secured against a Cambodian scam conglomerate in late 2025 was historic precisely because it was so rare; most victims of a deepfake Zoom call will never see their coins again. For individuals, the U.S. Federal Bureau of Investigation logged $9.3 billion in crypto-related losses in 2024, and only a sliver is ever recovered.

The defense that works is out-of-band

If the attack hides inside a trusted context, the defense has to come from outside that context. The single most useful habit is out-of-band verification: confirm who you are dealing with, and any instruction that touches money or keys, on a separate channel you chose and control. A podcast booking that arrived as an X DM is verified by a call to a number you looked up yourself, not the Calendly link you were sent. An urgent transfer request on a video call is confirmed by a second, pre-agreed method before anything moves.

From there, the concrete controls are specific and, mostly, free:

• Never install software, grant remote control, or run a pasted command for a meeting or interview on a device that touches your keys. Use a throwaway laptop or a disposable virtual machine for calls and coding tests, as SEAL advises.
• Disable Zoom’s remote-control and screen-control feature for your account and across your organization; it is the exact capability ELUSIVE COMET abuses.
• Treat any paste-this-command or run-this-to-fix-it step as hostile by default. No legitimate service needs it.
• Put hardware security keys or passkeys (FIDO2) on exchange and email logins, so a stolen password or session cookie is not enough to get in.
• Adopt a team or family safe word, and a rule that no transfer is ever executed on the strength of a single video call, no matter who appears to be on it.
• Keep the keys to serious money on hardware wallets, in cold storage, or behind a multisig, and never enter a seed phrase into any website, support portal, or form.

Deepfake detection is emerging as a layer, with vendors such as Reality Defender offering real-time analysis inside Zoom and Teams and research groups prototyping local detectors, but the detection window is shrinking as generation improves, so treat it as one signal among many rather than a verdict. The deeper fix is cultural: in a world where a face and a voice can be synthesized on demand, trust has to be anchored to something harder to fake than appearance, whether that is a cryptographic credential, a prior shared secret, or a verified second channel.

A field guide to the 2026 campaigns

The named operations differ in target and tooling but share a skeleton: a trusted pretext, a live or synthetic operator, and a payload delivered through a step the victim performs themselves. Laid side by side, the pattern is easy to recognize, which is the first line of defense.

What enforcement can and cannot do

Public agencies have scaled up. In the United States, the Securities and Exchange Commission and the Department of Justice have pursued crypto-fraud cases aggressively, the FBI’s Internet Crime Complaint Center publishes recurring alerts on AI-driven impersonation, and cross-border operations now coordinate takedowns of scam infrastructure across continents. Those efforts matter, and the occasional blockbuster forfeiture shows what is possible when the money lands somewhere reachable.

The limits are structural, though. Jurisdiction stops at a compound wall in Southeast Asia or the North Korean border, and the operators who run deepfake calls and fake-recruiter funnels sit well outside the reach of a U.S. subpoena. Sanctions and indictments raise the cost of doing business and occasionally freeze funds in transit, but they do not switch the campaigns off, and attribution arrives faster than recovery ever will. For a founder weighing whether to accept a last-minute Zoom invite, the enforcement apparatus is not a safety net. The practical defense is still the one in your own hands and your own operating procedures.

If you think you clicked, granted, or pasted

Speed is the only real remedy once a device is compromised, because you cannot clean a key an attacker may already have copied. If you suspect you granted remote control, ran a pasted command, or installed something during a call or interview, work through this sequence from a different, clean device:

• Disconnect the suspect machine from the internet immediately, but avoid wiping it yet if you can preserve evidence for investigators.
• From a separate clean device, move any funds in hot wallets whose keys touched the compromised machine to a brand-new wallet generated offline.
• Revoke outstanding token approvals using a tool like revoke.cash, and assume any seed phrase ever entered on that device is permanently burned.
• Rotate every password, sign out all sessions, and switch exchange and email accounts to hardware-key or passkey two-factor authentication.
• Reimage or fully wipe the compromised device before you trust it again.
• Report the theft to your exchange, to the FBI’s IC3 portal or your national equivalent, and, for live help, to SEAL’s emergency channel, which runs incident response for the crypto community.

None of this guarantees recovery. It is damage control, and the honest framing is that prevention, the out-of-band habit and the disposable device, is worth far more than any response plan.

Frequently Asked Questions

What is spear-phishing in crypto, and how is it different from a wallet drainer?

Spear-phishing is a targeted social-engineering attack aimed at a specific, high-value person rather than a broad pool of wallets. Instead of a mass fake-airdrop link that tricks you into signing a malicious transaction, a spear-phishing campaign reaches one chosen individual through a trusted pretext such as a media interview, a job offer, a venture-capital meeting, or a support ticket, and steals access through remote control, malware, or a surrendered seed phrase. In 2026, mass wallet-drainer losses fell sharply while these targeted operations grew in value stolen per victim.

How did the ELUSIVE COMET Zoom scam actually work?

ELUSIVE COMET, a threat actor tracked by The Security Alliance, posed as a venture firm and a podcast under fake brands, invited crypto executives to a Zoom interview, and on the call asked the guest to share their screen. The attacker then used Zoom’s built-in remote-control request and renamed their display name to Zoom so the prompt looked like a system message, and a guest who approved it handed over control of their computer. That let the attacker install malware; Emblem Vault chief executive Jake Gallen lost more than $100,000 this way in April 2025.

Are deepfake video calls really being used to steal crypto?

Yes. In February 2026, Mandiant disclosed a North Korean campaign it tracks as UNC1069 that used a compromised Telegram account, a fake Zoom meeting, and a reported AI-generated deepfake of a crypto executive to push a victim into running malicious commands on a macOS device. Mandiant cautioned that it could not independently verify the on-call video was synthetic in that instance, but separate fake-recruiter campaigns have used AI face-swapping during live interviews, and the technique is becoming a standard part of the toolkit.

If phishing losses fell in 2025, why do attacks feel worse than ever?

Because two trends moved in opposite directions. Automated wallet-drainer phishing that targets huge numbers of wallets fell about 83% in value in 2025 as wallet warnings and transaction simulation improved. At the same time, targeted social-engineering campaigns grew, and the money stolen per victim climbed into the six, seven, and even nine figures; in January 2026, two victims alone accounted for 65% of the month’s signature-phishing losses. Fewer people are hit, but the hits are far larger.

How do I protect myself from fake-interview and fake-meeting phishing?

Verify identity and instructions out-of-band, on a channel you chose rather than the one the stranger provided. Never grant remote control, install software, or paste a command into a terminal for a call or interview, and keep that activity on a disposable device or virtual machine that never touches your keys. Disable Zoom’s remote-control feature, put hardware-key or passkey two-factor authentication on your accounts, keep serious funds behind a hardware wallet or multisig, and never type a seed phrase into any website or support portal.

Anneke de Vries covers security and exploits for HOGE Wire, reporting on wallet security, social engineering, and on-chain forensics.