StardustChollima, also known as BlueNoroff, has recently been involved in stealing Telegram (TG) accounts to facilitate phishing attacks using a technique dubbed “ZoomClickFIX.” This tactic involves creating a deceptive Zoom meeting link that appears to be legitimate. In the attack, the normal Zoom URL presented to users is hxxps://reforge.zoom.us/j/2721598407?pwd=hblaw88iAFZz37obAHYBTNmHuikirt. However, once the link is clicked, users are redirected to a disguised address that modifies the original URL to hxxps://reforge.web05zoom.us/j/2721598407?pwd=hblaw88iAFZz37obAHYBTNmHuikirt.