The U.S. Federal Bureau of Investigation (FBI) has reported that North Korea-linked cyber actors stole more than $400 million in cryptocurrency over the past 18 months through a social engineering operation known as FaceStealer. The campaign has targeted individuals and organisations in the cryptocurrency and Web3 sectors, as well as developers and maintainers of open-source software. As part of coordinated enforcement actions announced on November 12, 2026, the U.S. government seized cloud-based infrastructure used in the operation. The FBI also confirmed that investigators recovered more than 900 webcam recordings of victims that had been collected and used by the threat actors to impersonate people in subsequent attacks. Separately, the U.S. Department of Justice (DOJ) announced court-authorised seizure and restraint of more than $1.2 billion in cryptocurrency stolen from Binance in a different cyber incident attributed to North Korea-linked TraderTraitor actors. The DOJ said cryptocurrency theft has been used to generate funds for North Korea’s illicit weapons programme. FBI Cyber Branch Operations Director Brett Leatherman said the FaceStealer operation had aggressively targeted people in the cryptocurrency and Web3 industries through deceptive social engineering. The FBI attributes the activity to a threat cluster publicly tracked under several names, including BlueNoroff, Sapphire Sleet, UNC1069, Stardust Chollima and APT38. These attributions reflect the agency’s assessment of the cyber activity and its links to North Korea.
FaceStealer relies on fake video conferencing platforms, secretly recorded webcam footage and deceptive communication to gain the trust of potential victims. According to the FBI, attackers first compromise an individual and obtain access to communication accounts, contact lists and other sensitive information. They may take control of accounts on platforms such as Telegram, LinkedIn, Slack and Discord, then use the compromised identities to approach the victims’ professional and personal contacts. Targets are invited to video meetings, often under the pretext of discussing investment opportunities, business collaboration or other professional matters. The invitations may be accompanied by scheduling links and websites designed to imitate services such as Zoom and Microsoft Teams. When a target joins the fraudulent meeting, attackers play prerecorded webcam footage of a previously compromised person, sometimes adding other recorded or AI-generated participants to make the interaction appear genuine. The FBI said the attackers have also begun using artificial intelligence to create deepfake videos of influential individuals in the cryptocurrency and Web3 sectors. After establishing trust, the attackers introduce a fabricated technical problem, such as an audio issue, and tell the target to install an update, run a script or enter commands into a computer terminal. These instructions actually trigger malware installation, giving attackers access to sensitive information, cryptocurrency wallets and other systems. The newly compromised individual can then be used to approach further contacts, allowing the operation to repeat through trusted professional relationships.
The FBI’s November 12 advisory also warns that the operation has expanded beyond direct cryptocurrency theft to attempts against the open-source software supply chain. Developers and maintainers are valuable targets because their devices and software repository accounts may provide access to widely used projects. If attackers compromise a maintainer’s credentials, they could attempt to introduce malicious code or dependencies into legitimate software, potentially affecting downstream users. The FBI described an earlier attempt involving a maintainer of a widely used JavaScript library, in which attackers used a fake Microsoft Teams meeting and deceptive technical instructions to gain access to the developer’s computer. The agency said the attackers subsequently attempted to use that access to introduce malicious dependencies into the software distribution process, but the activity was detected and addressed before it could lead to wider impact. Research published by Arctic Wolf in November 2026 also documented the evolving BlueNoroff operation. The company identified 677 individuals across 58 countries in the threat actors’ targeting material, compared with roughly 400 individuals identified in its earlier research. Founders and senior executives accounted for 84% of the identified targets. Arctic Wolf clarified that these figures represent individuals for whom the attackers had prepared targeting material, rather than confirmed victims or successful compromises. Its research also described the growing use of generative AI to produce artwork, avatars and synthetic participant videos, alongside new approaches involving financial documents, browser updates and other professional workflows. The FBI’s attribution of FaceStealer to North Korea-linked actors and the researchers’ findings highlight the continuing focus on people with access to cryptocurrency assets, business funds and software development infrastructure.
FaceStealer should be distinguished from another North Korea-linked operation known as Contagious Interview, which uses recruitment-themed social engineering to target software developers and IT professionals. In these campaigns, attackers pose as recruiters or prospective employers and encourage candidates to download coding assignments, open unfamiliar software repositories or run files as part of an interview process. A joint advisory published by cybersecurity and intelligence agencies from Japan, the United States, Australia and Germany in September 2026 reported that the separate Contagious Interview activity had infected at least 30,000 devices across more than 100 countries. Recent research by JFrog also documented a fraudulent recruitment operation using a fabricated company identity and malicious coding assignments to deceive developers. Separately, Sophos reported that one of its corporate macOS devices was compromised after an employee opened a repository presented as a job interview assignment in Visual Studio Code. These incidents illustrate the broader risks associated with recruitment-themed cybercrime, but their statistics and attack details should not be combined with FaceStealer. The FBI has advised cryptocurrency professionals and open-source software maintainers to use official video conferencing applications, verify unusual meeting invitations through separate communication channels and avoid running scripts or copying commands into terminals when prompted by supposed technical support. It also recommends strengthening account security with multifactor authentication and protecting cryptocurrency recovery phrases and private keys. The disruption of FaceStealer infrastructure and the seizure of cryptocurrency assets mark coordinated enforcement efforts against the reported operations, while the FBI’s advisory highlights the need for continued vigilance against impersonation, deepfake-assisted deception and attempts to compromise trusted software development environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
