FBI says North Korean hackers stole more than $400 million in cryptocurrency through deepfake video calls - news.lavx.hu

The U.S. Federal Bureau of Investigation (FBI) has tied a North Korean social engineering campaign known as FaceStealer to more than $400 million in cryptocurrency theft over 18 months. U.S. authorities seized cloud infrastructure tied to the operation and announced court-authorized actions to restrain more than $1.2 billion in cryptocurrency stolen in a separate Binance hack attributed to the North Korea-linked TraderTraitor group.

The U.S. Department of Justice emphasized that the stolen assets support Pyongyang's weapons program. "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," Brett Leatherman, director of the FBI Cyber Branch, said in a statement.

Deepfake deception

Investigators revealed that FaceStealer uses recorded videos and deepfakes to gain targets' trust during video meetings. The campaign shares traits with activity documented as GhostCall by Kaspersky in October 2025. The FBI linked the operation to BlueNoroff, a financially motivated North Korean cluster also tracked as APT38, Sapphire Sleet and Stardust Chollima.

Attackers start by taking over accounts of previous victims. They contact people in the victim's network and propose video meetings, often framed around investment discussions. Before the call, they send scheduling links and then meeting links that imitate Zoom or Microsoft Teams. Researchers at JUMPSEC identified typosquatted domains used in the campaign, including uu01webzoom[.]us and teams.livemeet[.]us.

Self-spreading threat

JUMPSEC described FaceStealer as a platform that turns each compromise into the next round of outreach. After gaining control of a device, attackers harvest wallet data and seed phrases, lock victims out of messaging accounts, and mine contact lists from services like Telegram, LinkedIn, Slack and Discord. They then use those relationships to invite new targets to fake meetings and repeat the cycle.

The FBI seized more than 900 victim webcam recordings that attackers planned to reuse in future impersonation attempts. The campaign has targeted software developers, maintainers and libraries with large download counts. The Justice Department noted attackers used FaceStealer to target a maintainer of the Axios npm package earlier this year and push a trojanized version.

Arctic Wolf reported that the campaign targeted more than 677 people across 58 countries, with founders and C-suite executives making up more than 80% of targets. Attackers expanded reconnaissance to YouTube interviews and conference talks and used generative tools from ChatGPT, Google, xAI's Grok and Wondershare to produce lures and synthetic meeting content.

Protecting against attacks

Security teams and individuals in cryptocurrency, finance and software development can reduce exposure by confirming meeting links through separate channels before joining, especially when sent on short notice or from domains differing from official services. Requests to run commands, install updates or copy code during calls should be treated as warning signs.

Organizations should open interview assignments, unknown repositories and downloaded files in disposable virtual machines instead of work devices. JFrog researchers advised employers to set this rule after uncovering a decoy company, AccuraSoftHire, that used careers sites and verified recruiter profiles to distribute malicious assessments.

The FBI asked potential victims and organizations to report incidents through its Internet Crime Complaint Center at ic3.gov. The campaigns continue to evolve, with FaceStealer operating alongside another North Korean campaign called Contagious Interview, which uses fake job offers and technical assessments to deliver malware.