The U.S. Federal Bureau of Investigation (FBI) has seized infrastructure used by North Korean hackers behind a cryptocurrency theft campaign known as FaceStealer, which has stolen more than $400 million over the past 18 months.
The operation targeted individuals working in the cryptocurrency and Web3 industries through sophisticated social engineering attacks involving deepfake videos, fake video meetings, and malware.
The coordinated enforcement action also includes the U.S. Department of Justice’s court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency recently stolen by North Korea-linked TraderTraitor actors following an attack on cryptocurrency exchange Binance. U.S. authorities say the stolen funds help finance North Korea’s illicit weapons programs.
According to the FBI, FaceStealer relies on deceptive video meetings to gain victims’ trust before tricking them into installing malware. The campaign is attributed to BlueNoroff, a financially motivated North Korean threat group also tracked as APT38, Sapphire Sleet, Stardust Chollima, and UNC1069, among other names.
The attackers typically begin by compromising the social media or messaging accounts of people working in cryptocurrency and technology organizations. They then use those trusted accounts to send meeting invitations to the victims’ contacts, often pretending to discuss business opportunities or investments.
When a target joins the meeting, attackers play prerecorded webcam footage of someone the victim recognizes. They also use deepfake videos of influential individuals in the cryptocurrency and Web3 industries to make the conversation appear legitimate. In some cases, the attackers use artificially generated profile images and multiple prerecorded participants to create the impression of a genuine business meeting.
After a few seconds, the attackers introduce a fake technical problem, claiming that the victim’s microphone or audio connection is not working. They then provide a link or instructions to resolve the supposed issue. The technique resembles ClickFix attacks, where victims are manipulated into executing malicious commands or downloading malware themselves.
Once installed, the malware can steal cryptocurrency wallet information, seed phrases, sensitive files, and authentication details. Attackers can also use the compromised device and communication accounts to target additional victims.
Security researchers at JUMPSEC previously documented how the operation uses phishing infrastructure impersonating popular video conferencing platforms such as Zoom and Microsoft Teams. The attackers distribute fake meeting links through compromised Telegram accounts, sometimes using domains designed to resemble legitimate services.
The campaign also uses compromised accounts on LinkedIn, Slack, Discord, and other communication platforms to maintain access to victims’ professional and personal networks. After taking control of an account, attackers can access contact lists and previous conversations to identify additional targets and send convincing invitations.
The FBI said it has seized more than 900 webcam recordings used by the hackers to impersonate previous victims in subsequent attacks. The agency also warned that North Korean operators have attempted to target software developers, maintainers, and widely used software libraries.
BlueNoroff’s activities extend beyond cryptocurrency theft. The group has also targeted software developers and open-source project maintainers to gain access to development environments and repository accounts. Earlier this year, the FaceStealer operation was linked to an attack targeting the maintainer of the popular Axios npm package, where attackers attempted to distribute a trojanized version containing a cross-platform remote access trojan.
Research published by Arctic Wolf in April 2026 identified more than 400 victims across over 20 countries. The campaign has since expanded, with researchers identifying 677 targets across 58 countries. More than 80% of the identified targets are founders and senior executives, reflecting the attackers’ focus on people with access to cryptocurrency assets, financial infrastructure, and sensitive business information.
The attackers have also expanded their use of generative AI tools to produce convincing artwork, avatars, and synthetic videos. Researchers reported that the group has used tools from OpenAI, Google, SpaceXAI Grok, and Wondershare to create realistic impersonation material. They have also collected images and voice recordings from public interviews, conference presentations, and YouTube videos to create convincing fake meeting participants.
However, FaceStealer is separate from another North Korean campaign known as Contagious Interview, which uses fake recruitment processes and technical assessments to infect software developers with malware.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
In these attacks, threat actors pose as recruiters on platforms such as LinkedIn and ask candidates to download coding assignments or participate in technical interviews. Malicious code can be hidden inside project files, Visual Studio Code configurations, Git hooks, or software installers.
Security researchers have also identified fake recruitment companies created to make these operations appear legitimate. One example is AccuraSoftHire, which reportedly operated a professional-looking careers website, LinkedIn presence, job advertisements, and recruiter profiles to convince candidates to run malicious coding assignments.
FBI Seizes FaceStealer Infrastructure After North Korean Hackers Steal $400 Million in Crypto
