Overview of the FaceStealer Campaign
The FaceStealer campaign, run by North Korean hackers, targeted individuals in the cryptocurrency and Web3 sectors, as well as open-source developers. The campaign ran for 18 months before the US seized the underlying cloud-based infrastructure.
Targeted Individuals
The FaceStealer campaign primarily targeted individuals in the cryptocurrency and Web3 sectors, including company founders and senior executives. The FBI identified more than 900 webcam videos secretly recorded of tech workers who were deceived in the massive North Korean operation.
Social Engineering Techniques
The FaceStealer campaign used multiple social engineering techniques, including deepfakes and ClickFix, to deceive targets. The attackers used various lures, such as financial documents, fake PDF viewer updates, identity verification prompts, and security audits, to persuade targets to run a 'fix.'
Attack Mechanics
During the video calls, the attacker would secretly record a video of the target, adding pressure on the current victim in the next stage. The hacker would then claim a technical issue and display a fake error message to justify delivering a malicious 'fix.' The target was then prompted to follow a link that purported to offer a fix, such as an update or installer, which infected their computer with malware that steals crypto data and account credentials for video meeting platforms like Zoom, Google Meet, and Microsoft Teams.
Additional Attacks
Huntress cybersecurity company attributed a similar campaign to BlueNoroff in 2025, where the attackers used Zoom calls to infect company executives with custom macOS malware. The FBI bulletin highlighted an incident in which the hackers compromised the maintainer of a popular open-source JavaScript library with tens of millions of weekly downloads, after luring them into a fake Teams meeting with multiple participants, including one familiar to the developer.
Defense Strategies
To defend against these attacks, users are recommended to join meetings only through official apps using an invite code, verify unexpected invitations independently, and keep the webcam off unless explicitly needed. Finally, avoid running scripts offered as fixes to technical problems.
Separate Announcements
In a separate announcement, the US Justice Department froze over $2.7 billion from the 6.4 billion Binance crypto heist. The DoJ has already obtained court authorization to seize or restrain in excess of $1.2 billion of that amount.
Related Developments
Amazon threat analysts attributed several open-source software supply chain attacks to BlueNoroff in a July 2026 report. The FBI agent who stole $2.5 million in crypto from hackers under investigation was linked to the North Korean WaterPlum hackers, who infected 30,000 devices worldwide. The Bitget crypto exchange hack resulted in a $351.6 million theft.
Conclusion
The US government's disruption of the FaceStealer campaign underscores the sophistication of North Korean cyber threats and the importance of robust cybersecurity measures to protect against such attacks.
Comments