FBI Says North Korea-Linked Actors Stole Over $400 Million Through FaceStealer
Summary
The FBI says North Korea-linked BlueNoroff actors stole over $400 million in 18 months through FaceStealer, using deepfake video calls and ClickFix-style malware lures. U.S. authorities seized campaign infrastructure and more than 900 victim recordings.
Key points
- The FBI says North Korea-linked actors stole more than $400 million in cryptocurrency through FaceStealer over the past 18 months.
- U.S. authorities seized cloud infrastructure used in the campaign; the FBI also seized more than 900 webcam recordings used to impersonate victims.
- FaceStealer lures targets into video meetings using compromised accounts, records their video, and uses prerecorded or deepfake footage to build trust before presenting a fake technical error and malware link.
- The campaign targets people in crypto, Web3, and software development, seeking access to devices and repository accounts; the article says it was used against the maintainer of the Axios npm package to push a trojanized version.
- Arctic Wolf reported 677 targets across 58 countries, with more than 80% described as founders or C-suite executives.
- Separately, the DOJ announced court-authorized seizure and restraint of over $1.2 billion in cryptocurrency it said was stolen by TraderTraitor actors after the Binance exchange hack.
- The article distinguishes FaceStealer from ClickFake Interview, a separate recruitment-themed campaign associated with Contagious Interview.
Article Details
- Event Type
- Cryptocurrency theft and infrastructure seizure
- Impact
- The FBI says actors tied to North Korea stole more than $400 million in cryptocurrency through the FaceStealer social-engineering scheme over 18 months. U.S. authorities seized cloud infrastructure used in the campaign and more than 900 webcam recordings used to impersonate victims. Separately, the DOJ announced the court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency stolen after the Binance hack by North Korea-linked TraderTraitor actors. Reported targeting includes cryptocurrency and Web3 workers, software developers, and maintainers; the campaign also resulted in a trojanized Axios package being pushed.
MITRE ATT&CK
T1059.006 · PythonInvisibleFerret is identified as a Python backdoor delivered in a separate Contagious Interview incident.T1059.007 · JavaScriptBeaverTail is identified as a JavaScript loader used in a separate Contagious Interview incident.T1204.001 · Malicious LinkVictims are directed to follow a link presented as a fix for a fictitious meeting technical issue, leading to malware installation.T1204.002 · Malicious FileIn a separate Contagious Interview incident described in the article, a victim cloned and opened a malicious code repository as a VS Code workspace.T1566.002 · Spearphishing LinkThe campaign uses deceptive meeting invitations and links delivered through compromised accounts as phishing lures.T1656 · ImpersonationFaceStealer operators use recorded victim videos and deepfakes to impersonate trusted people during meetings.
People
Alina KrasavinaDelivery Hero engineering manager who reported being targeted by two fake recruiters and described the malicious assessment and video-call approaches.Brett LeathermanFBI Cyber Branch Operations Director who described the alleged scale and financial purpose of North Korean cyber actors' cryptocurrency theft.Guy KorolevskiSenior security researcher at JFrog Security Research who discussed the decoy hiring operation and offered security guidance.
Threat Actors
APT38The article explicitly lists APT38 as a cryptonym for BlueNoroff, which it links to the FaceStealer campaign.BlueNoroffThe article links this North Korea-associated financially motivated threat cluster to FaceStealer and describes its targeting of cryptocurrency and Web3 workers, developers, and maintainers.CageyChameleonThe article explicitly lists CageyChameleon as a cryptonym for BlueNoroff, which it links to the FaceStealer campaign.Jade SleetThe article describes TraderTraitor as North Korea-linked actors associated with the hack of Binance and cryptocurrency theft; the DOJ announced seizure and restraint of assets recently stolen by them.Sapphire SleetThe article explicitly lists CryptoCore as a cryptonym for BlueNoroff, which it links to the FaceStealer campaign.STARDUST CHOLLIMAThe article explicitly lists Stardust Chollima as a cryptonym for BlueNoroff, which it links to the FaceStealer campaign.UNC1069The article explicitly lists UNC1069 as a cryptonym for BlueNoroff, which it links to the FaceStealer campaign.
Malware
BeaverTailThe payload in question is BeaverTail, a JavaScript loader that's used to deliver a Python backdoor referred to as InvisibleFerret. Both malware families are attributed to Contagious Interview.InvisibleFerretThe payload in question is BeaverTail, a JavaScript loader that's used to deliver a Python backdoor referred to as InvisibleFerret. Both malware families are attributed to Contagious Interview.
Products
Axioschain attacks. Notably, the FaceStealer scheme was put to use in targeting the maintainer of the popular Axios npm package earlier this year to push a trojanized version that delivered a cross-platform remote accessChatGPTthemes such as a fake Chrome PDF Viewer update, the campaign incorporates generative AI technology from ChatGPT, Google, SpaceXAI Grok, and Wondershare AI Content Generator (AIGC) to supply the attackers with artwork,Chrome PDF Viewerthe targets are founders and C-suite executives. Besides introducing new lure themes such as a fake Chrome PDF Viewer update, the campaign incorporates generative AI technology from ChatGPT, Google, SpaceXAI Grok, andDiscordThis includes hijacking social media and communications accounts such as Telegram, LinkedIn, Slack, and Discord for extended periods of time, and then accessing the victim's contact list to target the victim's personalGrokPDF Viewer update, the campaign incorporates generative AI technology from ChatGPT, Google, SpaceXAI Grok, and Wondershare AI Content Generator (AIGC) to supply the attackers with artwork, avatars, and convincingLinkedInThis includes hijacking social media and communications accounts such as Telegram, LinkedIn, Slack, and Discord for extended periods of time, and then accessing the victim's contact list to target the victim's personalMicrosoft Teamsis built atop a phishing kit designed to impersonate videoconferencing platforms like Zoom and Microsoft Teams. The cybersecurity company has characterized FaceStealer as a victim acquisition platform thatSlackThis includes hijacking social media and communications accounts such as Telegram, LinkedIn, Slack, and Discord for extended periods of time, and then accessing the victim's contact list to target the victim's personalTelegraminvolves using compromised trusted contacts as a pathway to fuel a self-propagating attack chain via Telegram.VS Codea public code repository presented as a job interview coding assignment and opened it as a workspace in VS Code.Wondershare AI Content Generator (AIGC)campaign incorporates generative AI technology from ChatGPT, Google, SpaceXAI Grok, and Wondershare AI Content Generator (AIGC) to supply the attackers with artwork, avatars, and convincing synthetic participantZoomoperation is built atop a phishing kit designed to impersonate videoconferencing platforms like Zoom and Microsoft Teams. The cybersecurity company has characterized FaceStealer as a victim acquisition
Countries
Australiajoint cybersecurity advisory published by cybersecurity and intelligence agencies from Japan, the U.S., Australia, and Germany in late September 2026, the long-running campaign is estimated to have compromised at leastGermanyadvisory published by cybersecurity and intelligence agencies from Japan, the U.S., Australia, and Germany in late September 2026, the long-running campaign is estimated to have compromised at least 30,000JapanAccording to a joint cybersecurity advisory published by cybersecurity and intelligence agencies from Japan, the U.S., Australia, and Germany in late September 2026, the long-running campaign is estimated to haveNorth Korea(FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social engineering schemeSingaporetargeted over 400 victims across more than 20 countries, with most of them concentrated in the U.S., Singapore, the U.K., Hong Kong, South Korea, and the U.A.E.South Koreamore than 20 countries, with most of them concentrated in the U.S., Singapore, the U.K., Hong Kong, South Korea, and the U.A.E.United Arab Emirateswith most of them concentrated in the U.S., Singapore, the U.K., Hong Kong, South Korea, and the U.A.E.United Kingdomover 400 victims across more than 20 countries, with most of them concentrated in the U.S., Singapore, the U.K., Hong Kong, South Korea, and the U.A.E.United StatesThe U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as