Ledger / 5 Nov 2025
North Korean UNC1069 used Gemini and deepfake lures for crypto theft
Confirmed
Google observed the Gemini misuse and the deepfake lures.
The group used Gemini for wallet-data research and code to steal crypto, wrote fake update prompts, and used deepfake lures to spread a backdoor.
“UNC1069 attempted to misuse Gemini to develop code to steal cryptocurrency, as well as to craft fraudulent instructions impersonating a software update to extract user credentials.”Google Threat Intelligence Group
Sources
- GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI ToolsGoogle Threat Intelligence Group · 5 Nov 2025 · primary source
- Disclosed
- 5 Nov 2025
- Activity
- 2025
- Actor
- UNC1069 (MASAN) (nation state), as attributed by Google Threat Intelligence Group
- Nexus
- North Korea
- Targets
- Cryptocurrency users and industry
- What the AI did
- Recon, Malware dev, Deepfake, Social engineering
- Model
- Gemini
- Model family
- Model basis
- stated by vendor
- Autonomy
- assist
- Outcome
- Account disabled.