The US government has disrupted FaceStealer, a North Korean social engineering operation that ran for 18 months and is credited with stealing more than 400 million dollars in cryptocurrency. Authorities seized the cloud infrastructure behind it and identified more than 900 webcam videos that the hackers had secretly recorded. The FBI issued an alert and an explainer, and the Justice Department announced related asset actions.
How the attacks worked
A security firm linked FaceStealer to the BlueNoroff hacker group and counted 677 targets across 58 countries, with a heavy focus on company founders and senior executives in the cryptocurrency and Web3 sectors, along with open-source developers. Another firm attributed a similar 2025 campaign to the same group, in which attackers used video calls to infect executives with custom macOS malware.
The hackers took over accounts on Telegram, LinkedIn, Slack and Discord and used them to invite victims to video meetings. During the calls they played recorded footage of people the target knew, to add social pressure, and secretly recorded the target while they waited for the meeting to begin, then reused those recordings against other victims. They claimed a technical fault, showed a fake error and sent the victim to a link offering a fix in the form of an update or installer. The malware stole crypto data and credentials for Zoom, Google Meet and Microsoft Teams and reached contact lists, social media, communication apps and webcam videos. Attackers sometimes waited months, or more than a year, before acting, likely while a victim's crypto holdings grew.
Supply-chain risk and advice
The FBI described an attempt to compromise the maintainer of a popular JavaScript library, with tens of millions of weekly downloads, through a fake Teams meeting; it was caught quickly. The FBI also confirmed other attempts against developers in the npm and Rust crate ecosystems. The report advises joining meetings only through official apps with an invite code, checking unexpected invitations independently, keeping webcams off unless needed and not running scripts offered as fixes. It mentions no India or Southeast Asia link.
