Federal authorities dismantle North Korean FaceStealer cyber scam that netted over $400 million

The United States government has taken down the cloud infrastructure behind FaceStealer, an 18-month North Korean social engineering campaign that stole more than $400 million in cryptocurrency. According to federal officials, the scheme targeted workers in the cryptocurrency and Web3 sectors as well as open-source developers, leading to the recovery of more than 900 secretly recorded webcam videos. Separately, the Department of Justice announced it secured court authorization to seize or restrain over $1.2 billion of the more than $2.7 billion frozen following a recent $6.3 billion Binance breach. [1][2]

To execute the scam, attackers hijacked accounts on services like LinkedIn, Slack, Telegram, and Discord to invite victims to phony video calls on platforms such as Microsoft Teams and Zoom. When targets logged in, they were met with prerecorded footage or deepfakes of familiar industry associates with no audio. The hackers claimed there were technical issues and prompted targets to download a fraudulent software fix. Running the installer infected victims' machines with malware that stole credentials, contact lists, and cryptocurrency data while secretly capturing the victim's webcam video to target others. [1][2]

The FBI attributes the campaign to the North Korean threat group known as Sapphire Sleet, while security researchers at Arctic Wolf and Huntress link the activity to BlueNoroff. The FBI noted the group leveraged the operation to attempt supply-chain compromises across npm and Rust ecosystems, including targeting the maintainer of a JavaScript library with tens of millions of weekly downloads. Federal officials warned that North Korean actors are increasingly combining emerging technology like deepfakes with targeted social engineering to fund the regime. [1][2]