"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," said FBI Cyber Branch Operations Director Brett Leatherman.
FaceStealer: deepfake video meetings and ClickFix-style lures
The FBI and the U.S. Department of Justice say a social‑engineering campaign codenamed FaceStealer has stolen more than $400 million in cryptocurrency in the past 18 months. FaceStealer uses surreptitiously recorded webcam streams and synthetic video to impersonate trusted contacts during what appear to be legitimate video meetings. The attackers present a manufactured "technical error" a few seconds into the call and push a ClickFix-style link or a script that, when executed, installs malware and steals wallets, seed phrases, and other credentials.
BlueNoroff and TraderTraitor: attribution, infrastructure seizure, and restrained assets
The DoJ and FBI tie FaceStealer activity to a North Korea‑linked financially motivated cluster tracked as BlueNoroff (also cataloged under names including APT38, CryptoCore, and UNC1069). In a coordinated U.S. government action, the cloud‑based infrastructure used to support the campaign has been seized. Separately, the DoJ announced court‑authorized seizure and restraint of more than $1.2 billion in cryptocurrency recently stolen by a North Korea‑linked actor called TraderTraitor following a hack of the Binance exchange. The DoJ said those plundered assets are used to fund Pyongyang's illicit weapons program.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleScale, targets, and geography: FBI, Arctic Wolf, and JUMPSEC findings
The FBI reported it seized more than 900 victim webcam video recordings used by the attackers to impersonate victims in follow‑on attacks. Arctic Wolf documented the campaign in April 2026 as targeting over 400 victims across more than 20 countries, concentrated in the U.S., Singapore, the U.K., Hong Kong, South Korea, and the U.A.E.; it later said the activity had expanded to 677 targets across 58 countries. Arctic Wolf reported that "a full 80% of identified targets operate directly in cryptocurrency/blockchain finance (54%) or adjacent finance and investment sectors (26%)," and that CEOs and founders alone account for 45% of the target set.
Tools and techniques: phishing kits, typosquatted meeting URLs, AI-generated media, and supply-chain abuse
JUMPSEC told The Hacker News in July 2026 that FaceStealer is built atop a phishing kit that impersonates videoconferencing platforms such as Zoom and Microsoft Teams and functions as a victim acquisition platform. Attackers hijack communications accounts — Telegram, LinkedIn, Slack, Discord — harvest contacts and chat histories, and use Calendly invites and typosquatted meeting URLs (examples include "uu01webzoom[.]us" and "teams.livemeet[.]us") to lure targets into fake meetings.
The DoJ said, "The North Korean hackers also use super intelligence (SI) to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries that make the FaceStealer scheme even more effective." The campaign also leverages generative AI from ChatGPT, Google, SpaceXAI Grok, and Wondershare AI Content Generator to produce avatars, artwork, and synthetic participant videos. Arctic Wolf added that lure material is scraped from profile photos, prior webcam streams, YouTube interviews and conference talks, enabling synthetic meeting footage without directly compromising a specific target in advance.
Contagious Interview, BeaverTail/InvisibleFerret, and the interview-as-attack vector
FaceStealer is distinct but related in technique to Contagious Interview and ClickFake Interview, which use recruitment and interview lures to get victims to run malicious code. A joint advisory from Japan, the U.S., Australia, and Germany estimated the long‑running campaign had compromised at least 30,000 devices in 100 countries. Attack delivery methods include embedding malware in coding tests and repositories, weaponizing VS Code workspace settings to run payloads automatically, and abusing Git hooks (.githooks/pre-commit, post-checkout) and trojanized installers.
Sophos disclosed that in mid‑September 2026 an employee's corporate macOS device was compromised after cloning a public code repository presented as a job interview assignment; the repository contained a weaponized VS Code workspace file that silently downloaded a multi‑stage payload. Researchers attribute the JavaScript loader BeaverTail and the Python backdoor InvisibleFerret to Contagious Interview. JFrog reported that threat actors even set up a decoy company named AccuraSoftHire with a careers site and verified recruiter profiles to lend credibility to malicious interview lures.
What this means for software developers, security teams, and cryptocurrency exchanges
- Software developers and open‑source maintainers: the campaign has specifically targeted developers and maintainers to enable software supply‑chain attacks. JUMPSEC and Arctic Wolf document attempts to compromise repository access and developer workstations; JFrog recommended that interview assignments with downloads be run only in disposable virtual machines.
- Security teams and enterprise IT: Sophos' incident shows a weaponized VS Code workspace can run a payload automatically. Security teams should review developer workflows, restrict execution of unvetted code on corporate devices, and heed warnings about running unknown installers or terminal commands presented during interviews.
- Cryptocurrency exchanges and investors: the DoJ's seizure of more than $1.2 billion tied to the TraderTraitor actor underlines how thefts feed state actors' illicit programs. Exchanges and custodians will be watching judicial restraint actions and law‑enforcement seizures closely as part of broader asset‑recovery and anti‑money‑laundering efforts.
The FBI and allied agencies have disrupted an operation that combined social engineering, account hijacking, synthetic media, and software‑supply‑chain vectors into a self‑propagating threat. The public record now documents stolen funds in the hundreds of millions, seized infrastructure, and tens of thousands of compromised devices; it also leaves a clear operational question for defenders: will companies and hiring teams adopt the procedural changes that researchers — JFrog and Sophos among them — have urged, such as disposable VMs for test code and stricter controls on recruiter‑driven workflows?
