The U.S. government has disrupted a North Korean social engineering campaign called “FaceStealer,” responsible for stealing more than $400 million in cryptocurrency.
FaceStealer's methods and scope
According to a U.S. law enforcement alert, FaceStealer combined multiple social-engineering techniques — including deepfakes and a tactic the bulletin describes as “ClickFix” — to ensnare targets in the cryptocurrency and Web3 sectors and among open-source developers. Attackers hijacked accounts on Telegram, LinkedIn, Slack, and Discord and used those accounts to invite victims to video meetings under false pretenses.
During calls, attackers sometimes played recorded footage of people the target knew who had already fallen victim. While a target waited for a meeting to begin, the adversary secretly recorded the target’s webcam feed; those recordings were later reused against other victims. The FBI identified more than 900 webcam videos secretly recorded of tech workers as part of the operation.
The operator would then claim a technical issue and show a fake error message to justify delivering a malicious “fix.” Targets were prompted to follow a link to an update or installer that installed malware. The FBI says that malware stole cryptocurrency data and account credentials for video meeting platforms such as Zoom, Google Meet, and Microsoft Teams, and provided access to contact lists, social media, communication apps, and webcam videos. The campaign ran for 18 months before U.S. authorities seized the underlying cloud-based infrastructure.
Attribution to BlueNoroff and related activity
Security researchers linked FaceStealer to the BlueNoroff group. ArticWolf researchers attributed the campaign to BlueNoroff and cataloged additional lures used to persuade targets to run the “fix,” including financial documents, fake PDF viewer updates, identity-verification prompts, and faux security-audit notifications. Huntress also attributed a similar campaign to BlueNoroff in 2025, reporting attackers used Zoom calls to infect company executives with custom macOS malware. Amazon threat analysts, in a July 2026 report, likewise attributed several open-source software supply-chain attacks to BlueNoroff.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageOpen-source maintainers and supply-chain targeting
The FBI bulletin highlights a notable incident in which attackers lured the maintainer of a popular open-source JavaScript library into a fake Teams meeting that included multiple participants — one of whom was familiar to the developer. That package reportedly had tens of millions of weekly downloads. The specific attack was thwarted because of quick detection, but the FBI confirmed multiple other attempts against developers in the npm and Rust crate ecosystems.
U.S. law enforcement and asset actions
U.S. authorities not only seized cloud infrastructure that supported FaceStealer after an 18‑month campaign, they also pursued a separate, large-scale recovery of cryptocurrency tied to a different incident. The Justice Department announced that, together with private-sector companies, the U.S. government froze more than $2.7 billion from the 6.4 billion Binance crypto heist and has already obtained court authorization to seize or restrain in excess of $1.2 billion of that amount.
How technologists, open-source maintainers, and crypto holders should respond
- Technologists and security teams: Verify meeting invitations independently and require official app joins with invite codes; disable webcams by default and treat unsolicited “fix” installers or scripts as high-risk.
- Open-source maintainers and package custodians: Be vigilant for social-engineering lures that replicate known collaborators in meeting invites; rapid detection and incident response can blunt attempted supply‑chain compromises.
- Crypto holders and executives: Expect adversaries to delay exploitation — the FBI notes attackers sometimes waited months or more than a year after initial compromise, likely to let holdings grow — and prioritize credentials and system hygiene that prevent post‑compromise lateral access.
FaceStealer shows how the attackers blended recorded human interactions, deepfakes, and conventional malware to convert social trust into account and key theft. U.S. actions interrupted the campaign’s infrastructure and pursued billions in frozen assets, but the campaign’s long run, the reuse of hundreds of recorded webcam videos, and confirmed attempts against widely used open-source ecosystems underline a persistent risk vector: attackers who weaponize personal familiarity and supply-chain trust. Will those removals and seizures change the adversary’s tactics, or only drive them to new platforms and lures? The facts reported so far show that detection and rapid response remain essential tools for defense.
