US disrupts North Korean campaign behind $400 million crypto theft - BleepingComputer
The U.S. government has dismantled a North Korean social engineering operation called 'FaceStealer' that stole over $400 million in cryptocurrency.
The FaceStealer campaign targeted individuals in the cryptocurrency and Web3 sectors, as well as open-source developers, using sophisticated social engineering techniques including deepfakes and a method called ClickFix. U.S. authorities identified more than 900 webcam videos that hackers secretly recorded of tech workers during the operation.
Infection Method
North Korean hackers hijacked accounts on Telegram, LinkedIn, Slack, and Discord to invite victims to video meetings. During these calls, attackers showed recorded footage of people the targets knew who had previously fallen victim. The hacker would then claim a technical issue and display a fake error message to justify delivering a malicious 'fix.'
The meeting sometimes featured recordings of multiple familiar individuals to add pressure on the current victim in the next stage.
Victims were prompted to follow a link that purported to offer a fix, such as an update or installer, which infected their computer with malware that steals crypto data and account credentials for video meeting platforms.
Global Impact
ArticWolf researchers attributed the FaceStealer campaign to the BlueNoroff hacker group and identified 677 targets across 58 countries, with a heavy focus on company founders and senior executives. The researchers listed additional lures including financial documents, fake PDF viewer updates, identity verification prompts, and security audits.
Huntress cybersecurity company attributed a similar campaign to BlueNoroff in 2025, where attackers used Zoom calls to infect company executives with custom macOS malware. The FBI highlighted an incident where hackers compromised the maintainer of a popular open-source JavaScript library.
Defense Measures
To defend against these attacks, users are recommended to join meetings only through official apps using an invite code, verify unexpected invitations independently, and keep the webcam off unless explicitly needed. Experts also advise avoiding running scripts offered as fixes to technical problems.
Separately, the U.S. Justice Department announced that with private sector companies, they froze more than $2.7 billion from the 6.4 billion Binance crypto heist, with court authorization to seize or restrain in excess of $1.2 billion of that amount.
Related
