FBI Seizes Infrastructure Linked to North Korean FaceStealer Campaign That Stole Over $400 Million in Cryptocurrency

The U.S. Federal Bureau of Investigation (FBI) has revealed that North Korean threat actors stole more than $400 million in cryptocurrency over the past 18 months through a sophisticated social engineering operation known as FaceStealer.

As part of a coordinated U.S. government operation, authorities have seized cloud infrastructure used to support the campaign. The operation relied on deceptive video meetings, stolen identities, and deepfake technology to target individuals working in the cryptocurrency and Web3 industries.

The U.S. Department of Justice (DoJ) also announced the court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency recently stolen by North Korea-linked TraderTraitor actors following the hack of cryptocurrency exchange Binance. According to the DoJ, cryptocurrency theft proceeds help fund North Korea's illicit weapons program.

The FBI attributed FaceStealer to North Korean cyber actors and warned that the campaign uses increasingly convincing social engineering techniques to compromise high-value individuals and their digital assets.

How the FaceStealer Campaign Works

FaceStealer is linked to BlueNoroff, a financially motivated North Korean threat group also tracked under names including APT38, Sapphire Sleet, Stardust Chollima, CryptoCore, and UNC1069.

The campaign begins by compromising trusted contacts and using their identities to approach potential victims.

Attackers send invitations to video meetings from accounts belonging to previously compromised individuals. When a target joins, the attackers play prerecorded webcam footage of someone the victim recognizes. In some cases, deepfake videos of influential people in the cryptocurrency and Web3 industries are used to make the interaction appear legitimate.

The victim's own video stream may also be secretly recorded for use in future attacks.

A few seconds into the meeting, attackers introduce a fake technical problem, such as an audio issue or a problem with the meeting software. The victim is then directed to a link or instructed to execute commands to supposedly resolve the issue.

This is a ClickFix-style social engineering technique that tricks victims into installing malware themselves.

Once executed, the malware can steal cryptocurrency-related information, compromise communication accounts, and provide attackers with access to additional systems.

A Self-Propagating Attack Through Trusted Contacts

Research has shown that FaceStealer operates as a victim acquisition platform, using compromised accounts to expand its reach through trusted professional and personal relationships.

The attack chain typically follows these stages:

1. Compromising an initial victim: Attackers steal cryptocurrency wallet information, seed phrases, and other sensitive credentials. They may also hijack Telegram or other communication accounts and secretly record the victim during video meetings.
2. Impersonating the victim: Using the compromised account, attackers contact the victim's friends, colleagues, and professional connections with personalized messages.
3. Arranging a fake meeting: Targets receive invitations to discuss investment opportunities through platforms such as Zoom or Microsoft Teams. Attackers may use Calendly invitations to make the process appear legitimate.
4. Using prerecorded videos and deepfakes: During the fake meeting, attackers play recorded webcam footage or AI-generated videos of trusted contacts and other supposed participants.
5. Delivering malware through fake technical fixes: Victims are told that they have an audio issue, outdated meeting software, or another technical problem. They are then encouraged to download an update, open a link, or execute malicious commands.
6. Repeating the attack: Once a new victim is compromised, their device and communication accounts can be used to target additional contacts.

The campaign has involved impersonation of services such as Zoom and Microsoft Teams through deceptive meeting links.

Deepfake Technology Makes the Attacks More Convincing

The use of generative AI has significantly increased the effectiveness of FaceStealer.

According to the DoJ, attackers use deepfake videos of well-known individuals, particularly those associated with cryptocurrency and Web3 businesses, to establish trust during video meetings.

Arctic Wolf reported that the campaign has expanded beyond collecting profile photographs and webcam recordings. Threat actors have also gathered footage from YouTube interviews and conference presentations to reproduce the likeness and voices of specific individuals.

The research identified 677 targets across 58 countries, with more than 80% reportedly being founders and C-suite executives.

Earlier research identified more than 400 victims across over 20 countries. The targeting has increasingly focused on individuals who control cryptocurrency assets, wallet infrastructure, exchange platforms, signing keys, and investment decisions.

Attackers have also used generative AI tools, including ChatGPT, Google, Grok, and Wondershare AI Content Generator, to create artwork, avatars, and synthetic participant videos.

The FBI has seized more than 900 webcam video recordings that were allegedly used by the threat actors to impersonate victims in subsequent attacks.

Software Developers and Open-Source Maintainers Are Also Targets

FaceStealer is not limited to cryptocurrency investors and executives. BlueNoroff has also targeted software developers and maintainers of widely used open-source projects.

The objective is to compromise developer devices and software repository accounts, potentially enabling software supply chain attacks.

Earlier this year, the operation was reportedly used against the maintainer of the popular Axios npm package to distribute a trojanized version containing a cross-platform remote access trojan (RAT).

The FBI also warned that North Korean hackers have attempted to target software developers, maintainers, and software libraries with significant download volumes.

This makes the campaign particularly concerning for organizations that depend on open-source software and trusted development environments.

FaceStealer Is Different From the Contagious Interview Campaign

Security researchers have also highlighted another North Korean-linked operation known as Contagious Interview, which uses recruitment-themed social engineering to distribute malware.

Although both campaigns rely on deception and ClickFix-style techniques, FaceStealer and Contagious Interview are distinct operations.

Contagious Interview typically involves attackers posing as recruiters on platforms such as LinkedIn and sending victims malicious coding assessments or asking them to execute suspicious projects.

In one reported incident, an engineering manager described receiving a Next.js coding assessment containing a hidden backdoor inside its configuration file. Another attacker attempted to convince the target to download and run a repository during a video interview.

Security researchers have documented several malware delivery methods associated with Contagious Interview, including:

• Malicious code embedded in coding assessments and software repositories.
• Weaponized Visual Studio Code tasks.json configuration files.
• Malicious .githooks scripts triggered during Git operations.
• Trojanized macOS utility installers.
• Multi-stage payloads delivering malware such as BeaverTail and InvisibleFerret.

A separate investigation also uncovered a fake recruitment company named AccuraSoftHire, complete with a careers website, LinkedIn presence, job advertisements, and recruiters designed to appear legitimate.

These operations demonstrate how attackers are exploiting professional networking, recruitment processes, and developer workflows to gain access to corporate systems.

How Organizations and Developers Can Protect Themselves

The FaceStealer campaign highlights the growing risks associated with deepfake-enabled social engineering and compromised professional identities.

Organizations, cryptocurrency businesses, and software developers should consider the following precautions:

1. Verify video meeting invitations: Confirm unexpected meeting requests through a separate, trusted communication channel, even when they come from familiar contacts.
2. Never execute commands to fix meeting issues: Do not paste commands into PowerShell, Terminal, or other command-line interfaces based on instructions received during an unexpected video call.
3. Avoid untrusted meeting updates: Download conferencing software and updates only from official vendor websites.
4. Protect communication accounts: Enable multifactor authentication on Telegram, LinkedIn, Slack, Discord, and other accounts used for professional communication.
5. Secure cryptocurrency wallets: Never share seed phrases or private keys. Use hardware wallets and appropriate transaction approval controls.
6. Isolate coding assessments: Run unfamiliar repositories and interview assignments inside disposable virtual machines rather than on corporate laptops or production systems.
7. Inspect development environments: Review VS Code workspace settings, tasks.json, Git hooks, package scripts, and other project configuration files before executing unfamiliar code.
8. Monitor software repositories: Protect maintainer accounts with strong authentication and review unexpected changes to packages and release artifacts.
9. Train employees against deepfake attacks: Educate staff about synthetic video, impersonation, fake technical errors, and recruitment-based malware delivery.

Conclusion

The FaceStealer campaign demonstrates how North Korean threat actors are combining social engineering, compromised identities, and generative AI to target cryptocurrency holders, business executives, and software developers.

By using deepfake videos and trusted contacts, attackers can make fraudulent meetings appear authentic and persuade victims to execute malware on their own devices.

The seizure of the campaign's cloud infrastructure and more than 900 impersonation videos represents a significant disruption. However, the broader threat remains relevant as attackers continue to adapt AI-generated content and professional communication channels for financial theft and software supply chain compromise.

Organizations should treat unexpected video meetings, recruitment assignments, and requests to execute technical fixes as potential security risks, even when they appear to come from trusted individuals.