Threat watch / Campaign
FaceStealer: North Korean fake video calls with deepfakes stole more than $400M
On November 12, 2026, the US Justice Department described FaceStealer, a North Korean social engineering campaign that lures cryptocurrency holders and open-source developers into video meetings, shows them deepfakes of trusted figures, then has them install malware disguised as a fix for a fake technical problem. It says the campaign led to the theft of more than $400 million in the last 18 months. The FBI seized cloud infrastructure used in the scheme and over 900 webcam videos of victims.
- Sector
- Many sectors
- Way in
- Phishing, social engineering
- Product or vendor
- None named
- webcam videos of victims seized by the FBI (not a count of people)[1]
- 900+
- How it happened
- The attackers invite targets to video meetings from accounts stolen from earlier victims. In the meeting they play prerecorded video of trusted contacts and deepfake videos, made with what the Justice Department calls super intelligence (SI), of well-known people from the cryptocurrency and web3 industries, and record the target's webcam. They then introduce a fake technical error, such as the target not being heard, and give a link or prompt to fix it; the fix installs malware. The theft sometimes comes several months to more than a year after the first compromise.[1][2] Checked 12 Nov 2026
- What was stolen
- Cryptocurrency, more than $400 million in the last 18 months according to the Justice Department, and access to the victims' devices. Against open-source developers, the attackers try to reach their devices and the software repository accounts they control.[1] Checked 12 Nov 2026
- Who was impacted
- People in the cryptocurrency and web3 industries and, increasingly, people who develop and maintain open-source software. The Justice Department says this targeting "appears calculated to enable software supply-chain attacks". It gives no victim count; the FBI seized over 900 webcam videos of FaceStealer victims.[1] Checked 12 Nov 2026
- Threat actor
- BlueNoroff →
Timeline
- The US Justice Department announces the disruption of FaceStealer. It attributes the campaign to North Korean hackers known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima, and says it led to the theft of more than $400 million in the last 18 months. [1][2]
- The US Attorney's Office for the Central District of California announces the disruption of cloud-based infrastructure used in the scheme. Under a federal warrant, the FBI seized over 900 webcam videos of victims. No defendant is named. [1][3]