- What: The FBI attributed FaceStealer, a social engineering campaign that uses recorded and deepfake video of trusted contacts on fake Zoom and Teams calls, to North Korea-linked BlueNoroff.
- Impact: More than $400 million in cryptocurrency was stolen in 18 months, and each compromised victim's accounts and recorded face were reused to attack their own contacts.
- Fix / mitigation: The U.S. government seized the campaign's cloud infrastructure, and the DoJ seized and restrained more than $1.2 billion in crypto tied to the TraderTraitor Binance hack.
- Who's at risk: Individuals in cryptocurrency, Web3 and open-source software maintenance, plus any organization whose staff take meetings booked through Telegram, LinkedIn, Slack or Discord.
Imagine getting a Telegram message from a colleague you have known for years. They want to talk about an investment opportunity. A Calendly invite follows. You join the Zoom call, and there they are on camera, along with a couple of other familiar faces. A few seconds in, a banner says nobody can hear you. You click the link to fix your audio. That click, according to the FBI, is how North Korean operators stole more than $400 million in cryptocurrency over the last 18 months.
The FBI has attributed the campaign, codenamed FaceStealer, to threat actors tied to the Democratic People's Republic of Korea. As part of a coordinated set of U.S. government actions announced on November 13, 2026, the cloud infrastructure behind the operation has been seized. In parallel, the Department of Justice announced the court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency recently stolen by the North Korea-linked TraderTraitor actors following the hack of the Binance exchange. The DoJ says the proceeds fund Pyongyang's illicit weapons program.
A face you trust, recorded from the last victim
FaceStealer does not depend on a zero-day. It depends on trust, and it gets that trust from earlier victims. Lures come from stolen accounts. When a target joins the meeting, attackers play prerecorded webcam video of a previous victim the target knows, while also recording the new target's own video stream for later reuse. The DoJ says the operators also use what it calls super intelligence (SI) to make deepfake videos of well-known figures in the cryptocurrency and Web3 industries, and those fakes appear in meetings too. Headshots generated with OpenAI ChatGPT fill in as static avatars, so the call looks like it has several real participants.
"North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics," said FBI Cyber Branch Operations Director Brett Leatherman. Officials call the campaign "hard-to-detect," and that fits: every signal a target would normally check, from a known sender to a familiar face to a real calendar invite, is either genuine or recorded from something genuine.
The chain, step by step
JUMPSEC, which shared a detailed report with The Hacker News in July 2026, describes FaceStealer as a victim acquisition platform built on a phishing kit that imitates Zoom and Microsoft Teams. The chain runs like this:
- Compromise: harvest wallets and seed phrases, hijack the victim's Telegram or other messaging account and lock them out, take their contacts and chat history, and secretly record them on video.
- Impersonate: message the victim's contacts as the victim, proposing a Zoom or Teams call about an investment opportunity.
- Schedule: send a Calendly invite through Telegram, then shortly before the call send a typosquatted meeting link such as uu01webzoom[.]us or teams.livemeet[.]us.
- Stage: play recorded video of the trusted contact along with other recorded or deepfake participants.
- Infect: claim an audio problem or a deprecated Zoom SDK and push the target to click an update link or paste code into a command line or Terminal, a ClickFix-style lure that deploys data-stealing malware.
- Repeat: use the new victim's device and accounts to go after their own contacts.
Every victim becomes the source for the next round: their accounts send the lures and their recorded face appears on the call. JUMPSEC says attackers hold Telegram, LinkedIn, Slack and Discord accounts for long periods, so one compromise exposes a person's whole personal and professional network.
Who is behind it
The activity is linked to BlueNoroff, a prolific, financially motivated North Korean cluster also tracked as APT38, CageyChameleon, CryptoCore, DangerousPassword, Nickel Gladstone, Sapphire Sleet, Stardust Chollima and UNC1069. Parts of FaceStealer overlap with the GhostCall campaign Kaspersky documented in October 2025. BlueNoroff targets people in cryptocurrency and Web3, as well as people who develop and maintain open-source software, because a developer's laptop and repository accounts are a way into software supply chain attacks. According to the source, FaceStealer was used against the maintainer of the popular Axios npm package.
The RedEye take
The seizure matters, but it should not reassure anyone. Losing infrastructure costs BlueNoroff some time. It does not take away the method, and the method is the real problem. FaceStealer shows that video, which security teams long treated as the safe fallback when email or chat seemed off, can be produced on demand from earlier victims. Plenty of organizations still tell staff to "jump on a call to confirm" before moving money or granting access. That advice now works for the attacker.
The open-source angle deserves more attention than the dollar total. A $400 million theft is a loss. A hijacked maintainer of a widely used npm package can turn into a downstream incident at thousands of companies that never heard of FaceStealer. When an individual developer gets socially engineered, the risk becomes enterprise risk, whether or not that developer is on anyone's payroll.
Everything in the meeting can look genuine. The one step that cannot be faked into legitimacy is the request to install an update or paste a command to fix the call. That moment is where training, policy and endpoint controls should focus.
What defenders should learn
- Stop treating video as proof of identity. Rewrite verification policies so that high-value requests are confirmed through a separate channel set up ahead of time, not through a call booked in the same thread as the request.
- Treat messaging app account takeover as a security incident. If a staff member loses access to their Telegram, LinkedIn, Slack or Discord account, assume their contacts are about to be targeted, and have a way to warn those contacts fast.
- Make any "fix your meeting" prompt a hard stop. Legitimate Zoom and Teams clients do not ask users to paste code into Terminal or install an SDK mid-call, so treat that pattern as a reportable event rather than a nuisance.
- Bring open-source maintainers into your threat model. Know which outside packages your builds rely on and who maintains them, and make sure your supply chain monitoring would catch a malicious release from a hijacked maintainer account.
- Recognize that your employees' faces are now attacker material. Staff in crypto, finance and engineering roles should know that their recorded video could be replayed against their colleagues, and that reporting a suspicious call protects their network as well as themselves.
The bottom line
FaceStealer is a nation-state operation that grows through human relationships instead of software vulnerabilities, and it has been effective enough to fund a weapons program. The infrastructure seizure and the $1.2 billion restraint are real wins. The playbook is still available, though, and it will come back under new domains. Organizations that adjust verification, account takeover response and supply chain visibility now will be in a better position when it does. Source: The Hacker News, Ravie Lakshmanan, November 13, 2026 (https://thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html).
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us