The U.S. Federal Bureau of Investigation (FBI) has established that risk actors tied to the Democratic Folks’s Republic of Korea (DPRK aka North Korea) have stolen greater than $400 million value of cryptocurrency as a part of a social engineering scheme codenamed FaceStealer within the final 18 months.
As a part of a coordinated set of actions introduced by the U.S. authorities, the cloud-based infrastructure used to drag off the “hard-to-detect” marketing campaign has been seized.
In tandem, the U.S. Division of Justice (DoJ) has introduced the court-authorized seizure and restraint of greater than $1.2 billion value of cryptocurrency not too long ago stolen by the North Korea-linked TraderTraitor actors following the hack of cryptocurrency trade Binance. The plundered digital belongings are used to fund Pyongyang’s illicit weapons program, the DoJ added.
“The North Korean regime depends on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of {dollars} lately,” mentioned FBI Cyber Department Operations Director Brett Leatherman in an announcement.
“North Korean cyber actors have used the FaceStealer scheme to aggressively goal people within the cryptocurrency and Web3 sectors via misleading social engineering techniques, ensuing within the theft of greater than $400 million within the final 18 months.”
In response to the Justice Division, FaceStealer depends on surreptitiously recorded movies and deepfakes to facilitate cryptocurrency theft. Some features of the exercise dovetail with a marketing campaign documented by Kaspersky beneath the title GhostCall in October 2025.
The exercise is linked to a prolific North Korea-linked financially motivated risk cluster tracked as BlueNoroff, which can be identified by the cryptonyms APT38, CageyChameleon, CryptoCore, DangerousPassword, Nickel Gladstone, Sapphire Sleet, Stardust Chollima, and UNC1069.
The marketing campaign includes luring targets with invites to video conferences delivered from stolen accounts belonging to prior victims. Targets who be part of the assembly have their video stream recorded, whereas concurrently serving an genuine, prerecorded webcam video of a earlier sufferer or victims identified to the goal to construct belief.
“The North Korean hackers additionally use tremendous intelligence (SI) to develop deepfake movies of well-known and influential people typically within the cryptocurrency and web3 industries that make the FaceStealer scheme much more efficient,” the DoJ mentioned. “Right here once more, they use the deepfake movies within the conferences with targets to realize the goal’s belief.”
A couple of seconds into the assembly, a mock technical error is offered to the sufferer, claiming that they can’t be heard, and they’re offered a hyperlink to handle the non-existent problem. The repair is a ClickFix-style lure that is designed to put in malware on the sufferer’s workstation and steal cryptocurrency, in addition to abuse the goal’s privileges to different laptop infrastructure.
In an in depth report shared with The Hacker Information in July 2026, JUMPSEC revealed how the social engineering operation is constructed atop a phishing package designed to impersonate videoconferencing platforms like Zoom and Microsoft Groups. The cybersecurity firm has characterised FaceStealer as a sufferer acquisition platform that includes utilizing compromised trusted contacts as a pathway to gasoline a self-propagating assault chain through Telegram.
This contains hijacking social media and communications accounts akin to Telegram, LinkedIn, Slack, and Discord for prolonged durations of time, after which accessing the sufferer’s contact checklist to focus on the sufferer’s private {and professional} circles.
All the assault performs out as follows –
- Compromise a sufferer: This includes harvesting cryptocurrency wallets, seed phrases, and different precious entry; hijacking their Telegram account or different communication app and locking them out; having access to their contacts and chat histories; and secretly recording them through the video chat.
- Exploit the sufferer’s Telegram account: The attacker impersonates the sufferer and sends tailor-made messages to different contacts on their behalf, proposing a Zoom or Groups assembly beneath the pretext of discussing an funding alternative.
- Arrange the assembly: Ought to the goal categorical curiosity, the attacker sends a Calendly invite through Telegram to schedule the video assembly. Shortly earlier than the scheduled assembly time, the sufferer’s Telegram account is used to ship a typosquatted hyperlink that masquerades as a gathering URL for Zoom (“uu01webzoom[.]us”) or Groups (“groups.livemeet[.]us”).
- Exploit recorded movies: When the goal joins the pretend Zoom assembly, the attacker performs an already recorded webcam video of the trusted contact and performs different movies, both recorded or deepfake movies, to offer the impression that there are a number of members within the assembly. As well as, headshot photographs generated utilizing OpenAI ChatGPT are used as static avatar placeholders on the pretend calls.
- Trick the goal into infecting themselves: The attacker sends a message to the goal, claiming there’s an audio problem or another technical error (e.g., a deprecated Zoom SDK), and urges them to click on on a hyperlink to use an replace to handle the issue. Alternatively, it might probably take the type of operating a script or copying and pasting malicious code into the command line or Terminal. This leads to the deployment of malware that may seize delicate knowledge from the compromised system, successfully turning the goal into the subsequent sufferer.
- Repeat the cycle: With the sufferer now compromised, the attacker features management of their system and social media accounts to propagate the assault to their contacts.
Assaults mounted by BlueNoroff are identified to particularly single out people working within the cryptocurrency and Web3 industries, together with people concerned within the growth and upkeep of open-source software program.
The objective is to acquire entry to the builders’ units and the software program repository accounts they management to facilitate software program provide chain assaults. Notably, the FaceStealer scheme was put to make use of in concentrating on the maintainer of the favored Axios npm bundle earlier this yr to push a trojanized model that delivered a cross-platform distant entry trojan (RAT).
Greater than 900 sufferer webcam video recordings utilized by the risk actors to impersonate victims in follow-on assaults have been seized by the FBI. The company mentioned it is “conscious of a number of different makes an attempt by North Korean hackers to focus on software program builders, maintainers, and software program libraries with vital obtain quantity.”
In a report revealed in April 2026, Arctic Wolf mentioned the focused social engineering marketing campaign had focused over 400 victims throughout greater than 20 international locations, with most of them concentrated within the U.S., Singapore, the U.Ok., Hong Kong, South Korea, and the U.A.E.
 |
| Deepfake video manufacturing pipeline (credit score: Arctic Wolf) |
“A full 80% of recognized targets function instantly in cryptocurrency/blockchain finance (54%) or adjoining finance and funding sectors (26%),” the cybersecurity firm famous on the time. “CEOs and founders alone account for 45% of the goal set – almost half. This underscores BlueNoroff’s singular operational focus: people with entry to cryptocurrency belongings, pockets infrastructure, trade platforms, or funding decision-making authority.”
The exercise has since expanded in scope, with 677 targets recognized throughout 58 international locations. Greater than 80% of the targets are founders and C-suite executives. Apart from introducing new lure themes akin to a pretend Chrome PDF Viewer replace, the marketing campaign incorporates generative AI expertise from ChatGPT, Google, SpaceXAI Grok, and Wondershare AI Content material Generator (AIGC) to provide the attackers with paintings, avatars, and convincing artificial participant movies.
“Upstream, reconnaissance has each widened and turn into extra deliberate,” the corporate added. “Lure materials has been scraped not simply from profile images and prior victims’ webcam streams, however from YouTube interviews and convention talks, that are screen-recorded by the actor. This permits them to seize a particular particular person’s likeness and voice – a founder maybe, or a CEO – after which create pretend assembly footage with out having to instantly compromise the goal themselves.”
 |
| BlueNoroff’s up to date assault movement (credit score: Arctic Wolf) |
Every new sufferer provides a pathway to additional the assault. The cyclic modus operandi nonetheless stays the beating coronary heart of the social engineering operation.
“Mixed with their new pretend media technology capabilities to provide various and credible lure content material, this presents a major escalation in BlueNoroff’s efforts to compromise high-value people who management funds, signing keys, delicate data, authenticated communications, and trusted skilled relationships,” Arctic Wolf mentioned.
From FaceStealer to Contagious Interview
It is value emphasizing right here that the FaceStealer marketing campaign is distinct from ClickFake Interview, an iteration of Contagious Interview that additionally employs ClickFix-style techniques to set off the execution of malware as a part of recruitment-themed campaigns.
Like FaceStealer, this includes the attackers approaching potential targets by posing as recruiters on platforms like LinkedIn and sharing a “technical evaluation” designed to run malware. In a put up shared on LinkedIn, Alina Krasavina, an engineering supervisor at Supply Hero, detailed how she was focused in October 2026 by two pretend recruiters on the identical day, 13 minutes aside.
“The primary one despatched a ‘technical evaluation’: a Subsequent.js challenge of 113 information. On the finish of subsequent.config.js, after 204 areas, there was a backdoor,” Krasavina mentioned. “The second did not ship any ZIP. On a video name, a ‘Member of Technical Employees’ requested me to share my complete display screen, obtain a repo, and run it. After I mentioned no, he instructed me it was ‘a requirement to proceed.’ After the decision, I wrote to the recruiter and requested for one more interview format. A few minute later she blocked me.”
“The 2 assaults had been inbuilt reverse methods. The primary one put the trouble into the code and virtually none into the recruiter. The second put it into the individuals, and I by no means even noticed its code.”
In response to a joint cybersecurity advisory revealed by cybersecurity and intelligence companies from Japan, the U.S., Australia, and Germany in late September 2026, the long-running marketing campaign is estimated to have compromised at the very least 30,000 units positioned in 100 international locations.
The assaults experiment with a number of supply strategies to persuade victims to run malicious code –
Final month, Sophos disclosed that an worker’s company macOS system had been compromised in mid-September 2026 after they cloned a public code repository offered as a job interview coding task and opened it as a workspace in VS Code.
“The repository contained a weaponized VS Code workspace settings file that changed the editor’s built-in terminal profile,” the cybersecurity firm mentioned. “When a terminal opened within the workspace, the modified profile silently downloaded and ran a multi-stage payload.”
The payload in query is BeaverTail, a JavaScript loader that is used to ship a Python backdoor known as InvisibleFerret. Each malware households are attributed to Contagious Interview.
Sophos mentioned the malware ran in reminiscence on the system for about 26 hours, proper from its execution on September 14, 2026, till it was rebooted a day later. The incident didn’t have an effect on any of its services or products, or buyer knowledge or their programs, it added.
What’s extra, current analysis from JFrog has uncovered that the risk actors linked to the marketing campaign have even arrange a decoy firm named AccuraSoftHire, full with a careers website, shopper testimonials, a LinkedIn web page, job adverts on mainstream boards, and verified recruiters in an try and lend credibility and in the end deceive candidates into operating malware via a rigged take-home check and a video verification step.
“Our analysis reveals these lures are constructed to cross the checks individuals depend on: an expert web site, a LinkedIn web page, job adverts on mainstream boards and recruiters with LinkedIn’s verified badge,” Man Korolevski, senior safety researcher at JFrog Safety Analysis, mentioned in an announcement shared with The Hacker Information.
“Builders and different workers with system entry cannot be anticipated to catch that on their very own, so employers have to set the principles. Interview assignments with downloads ought to solely ever run in a disposable digital machine, by no means on a piece laptop computer. Safety groups must also warn workers about downloading unknown information, even from a supply they assume they will belief. Builders may also examine when a recruiter’s profile was created and whether or not the corporate’s location is similar on each web page.”
