US disrupts North Korean campaign behind $400 million crypto theft

The U.S. government has disrupted a North Korean social engineering campaign called ‘FaceStealer’, responsible for stealing more than $400 million in cryptocurrency.

The attacks used multiple social engineering techniques, including deepfakes and ClickFix, to target individuals in the cryptocurrency and Web3 sectors, as well as open-source developers.

The FaceStealer campaign ran for 18 months before the U.S. seized the underlying cloud-based infrastructure.

U.S. authorities identified more than 900 webcam videos that hackers secretly recorded of tech workers, who were deceived in the massive North Korean operation.

An FBI alert earlier this week notes that the North Korean threat actor hijacked accounts on Telegram, LinkedIn, Slack, and Discord, and used them to invite victims to video meetings under various pretenses.

During the video calls, the attacker showed recorded footage of people the targets knew and who had previously fallen victim, too.

The FBI explains that while the target waited for the meeting to start, the hacker secretly recorded a video, which was later used with other targets. The meeting sometimes featured recordings of multiple familiar individuals to add pressure on the current victim in the next stage.

Shortly after, the hacker claimed a technical issue and displayed a fake error message to justify delivering a malicious “fix.”

The target was then prompted to follow a link that purported to offer a fix, such as an update or installer, which infected their computer with malware that steals crypto data and account credentials for video meeting platforms such as Zoom, Google Meet, and Microsoft Teams.

The malware also provides access to the victims’ contact lists, social media, communication apps, and webcam videos.

According to the FBI, attackers sometimes delayed targeting individuals for months or even more than a year after the initial compromise, likely waiting for their cryptocurrency holdings to grow.

ArticWolf researchers attributed the FaceStealer campaign to the BlueNoroff hacker group and listed additional lures, including financial documents, fake PDF viewer updates, identity verification prompts, and security audits, all designed to persuade the target to run a “fix.”

The researchers identified 677 targets across 58 countries, with a heavy focus on company founders and senior executives.

Huntress cybersecurity company attributed a similar campaign to BlueNoroff in 2025, where the attackers used Zoom calls to infect company executives with custom macOS malware.

The FBI bulletin highlighted an incident in which the hackers compromised the maintainer of a popular open-source JavaScript library with tens of millions of weekly downloads, after luring them into a fake Teams meeting with multiple participants, including one familiar to the developer.

The attack was thwarted thanks to quick detection, but the FBI says it confirmed multiple other attempts against developers in the npm and Rust crate ecosystems.

Amazon threat analysts also attributed several open-source software supply chain attacks to BlueNoroff in a July 2026 report.

To defend against these attacks, users are recommended to join meetings only through official apps using an invite code, verify unexpected invitations independently, and keep the webcam off unless explicitly needed. Finally, avoid running scripts offered as fixes to technical problems.

As a separate announcement, the U.S. Justice Department said that together with private sector companies, the U.S. government froze more than $2.7 billion from the 6.4 billion Binance crypto heist.

The DoJ has already “obtained court-authorization to seize or restrain in excess of $1.2 billion of that amount.”