FBI disrupts FaceStealer scheme tied to $400 million in crypto theft - finchannel
U.S. authorities have seized cloud infrastructure used in a North Korean operation that stole more than $400 million in cryptocurrency over 18 months.
The Justice Department announced the disruption on November 12, seizing more than 900 webcam recordings under a federal warrant. Investigators attributed the activity to North Korean hackers tracked as Sapphire Sleet or UNC1069, who targeted cryptocurrency holders and open-source software maintainers.
The scheme involved targets receiving invitations through compromised social-media or communications accounts of people they had previously interacted with. Counterfeit meetings imitated services including Zoom, Microsoft Teams and Google Meet, with attackers using fabricated technical problems as pretexts for infection.
Once a target joined the fake meeting, clicking the provided link infected their computer. The attackers recorded the new participant and used that person's contacts to approach additional targets. The FBI warned that attackers had begun generating AI videos of prominent cryptocurrency and blockchain figures to enhance credibility.
Software maintainers targeted
The FBI's advisory described an attempt earlier this year to compromise a maintainer of a major JavaScript library receiving tens of millions of weekly downloads. The attackers drew the maintainer into a fake Teams meeting, displayed a recognizable participant, and persuaded him to follow purported corrective instructions that infected his computer.
The attackers then used his access to create malicious dependencies intended to accompany legitimate library downloads, the advisory said. Rapid detection and response prevented the large-scale outcome the attackers sought.
Deceptive tactics documented
Microsoft described a campaign focused on Apple's macOS that began in early 2026, using fake recruiter profiles, employment conversations, and technical interview invitations. Targets were directed to install software presented as video-conferencing components or developer-tool updates.
JUMPSEC examined a BlueNoroff phishing kit that impersonated Zoom and Teams, documenting cases where hijacked Telegram accounts were used to approach senior employees. The counterfeit service collected webcam footage and checked for cryptocurrency-wallet software before delivering malware.
Separate Binance action
The Justice Department also described a separate action involving assets stolen from Binance. Authorities obtained court authorization to seize or restrain more than $1.2 billion, within a wider total exceeding $2.7 billion frozen through government and private-sector efforts.
The FBI attributed the Binance theft, involving more than $6 billion on October 29, to North Korean activity it calls TraderTraitor. The bureau and partner agencies asked virtual-asset providers to block transactions connected to identified addresses.
Official guidance issued
The FBI recommends using official applications and invitation codes for video meetings, confirming unexpected invitations through another channel, and declining instructions to run scripts as updates. The Federal Trade Commission advises contacting familiar people through known genuine numbers or websites when suspicious messages request link clicks or attachments.
The FTC also recommends automatic security updates, multifactor authentication, and backups. For suspected malware, it calls for updating security software, scanning computers, and removing detected threats. Victims are directed to IdentityTheft.gov for specific steps based on information lost.
Related
