North Korean hackers stole more than $400 million in cryptocurrency over the past 18 months through a social-engineering campaign that weaponizes fake video meetings, recorded webcam footage and artificial deepfakes, the FBI said. The bureau calls the operation FaceStealer and says U.S. authorities have disrupted cloud infrastructure used to run it. The FBI’s account of the campaign says investigators seized more than 900 webcam videos belonging to victims in the cryptocurrency and Web3 industries.
The attackers begin by compromising a victim’s communications or social-media accounts and using them to invite contacts to a meeting. The meeting is hosted on an imposter version of a familiar video-conferencing service, according to the Justice Department. Once a target joins, the operators can play prerecorded footage of a trusted contact—or use an AI-generated deepfake of a prominent cryptocurrency or Web3 figure—to make the interaction appear legitimate.
The deception is designed to produce a malware infection. Hackers introduce a supposed technical problem, such as a microphone failure, then direct the target to a link or prompt that claims to provide a fix. That “fix” installs malware, giving the operators access to cryptocurrency and other systems. In some cases, the theft or account takeover occurred months or more than a year after the initial compromise, while stolen contact lists and messaging accounts helped the attackers identify additional targets.
The campaign’s scope extends beyond direct cryptocurrency theft. The FBI and Justice Department said the operators are increasingly targeting open-source developers and maintainers in an apparent effort to obtain software-repository credentials and position themselves for supply-chain attacks. The FBI attributes the activity to North Korean actors known by names including Sapphire Sleet, UNC1069, APT38, BlueNoroff and Stardust Chollima. The agencies also announced the seizure of the FaceStealer infrastructure under a federal warrant.
No CVE, affected product version or patch is identified in the FBI or Justice Department materials; FaceStealer is a social-engineering and malware-delivery operation rather than a disclosed software vulnerability with a published CVSS score or public proof of concept. Organizations handling digital assets should treat unsolicited meeting invitations and “audio fix” prompts as potential intrusion attempts, verify contacts through an independent channel, avoid installing meeting software from links in messages, protect communications and repository accounts with phishing-resistant multifactor authentication, and consult the FBI’s FaceStealer guidance if a device or account may have been compromised.
