Ethical Hacking News
The U.S. Federal Bureau of Investigation (FBI) has uncovered a sophisticated North Korean hacking group's involvement in a massive cryptocurrency heist worth over $400 million. The hacking group, known as BlueNoroff, has been using deepfake video calls and phishing kits to steal cryptocurrency from individuals in the cryptocurrency and Web3 sectors. The FBI has seized the cloud-based infrastructure used to pull off the heist and has announced the court-authorized seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen by the North Korea-linked TraderTraitor actors.
The FBI has revealed that a North Korean hacking group was involved in a massive cryptocurrency heist, stealing over $400 million worth of cryptocurrency using a sophisticated social engineering scheme. The scheme, called FaceStealer, involves using deepfake video calls, phishing kits, and malware to compromise victims' devices and steal cryptocurrency. The hackers use a phishing kit to impersonate videoconferencing platforms and hijack victims' social media and communications accounts. The scheme has been linked to a prolific North Korea-linked financially motivated threat cluster tracked as BlueNoroff, also known as APT38, CageyChameleon, CryptoCore, and others. The hackers use super intelligence to develop deepfake videos of well-known and influential individuals in the cryptocurrency and web3 industries to gain their trust. The goal of the scheme is to obtain access to the developers' devices and software repository accounts to facilitate software supply chain attacks. More than $1.2 billion worth of cryptocurrency has been seized by the US Department of Justice, with the stolen funds believed to be used to fund Pyongyang's illicit weapons program. The FaceStealer scheme has targeted individuals in the cryptocurrency and Web3 industries, as well as individuals involved in the development and maintenance of open-source software. The scheme has been used to target over 400 victims across more than 20 countries, with most of them concentrated in the US, Singapore, the UK, Hong Kong, South Korea, and the UAE. Arctic Wolf has reported that 80% of identified targets operate directly in cryptocurrency/blockchain finance or adjacent finance and investment sectors.
The recent revelation by the U.S. Federal Bureau of Investigation (FBI) regarding the North Korean hacking group's involvement in a massive cryptocurrency heist has sent shockwaves throughout the cybersecurity community. According to the FBI, the threat actors, which are believed to be linked to the Democratic People's Republic of Korea (DPRK), have successfully stolen over $400 million worth of cryptocurrency using a sophisticated social engineering scheme codenamed FaceStealer.
The FaceStealer scheme, which was reportedly launched over the past 18 months, has been designed to exploit the vulnerabilities of individuals in the cryptocurrency and Web3 sectors. The scheme involves the use of deepfake video calls, which are surreptitiously recorded and used to gain the trust of the victim. Once the victim's trust is established, the attacker sends a link to a ClickFix-style lure, which is designed to install malware on the victim's workstation and steal cryptocurrency.
The FBI has also revealed that the North Korean hackers have been using a phishing kit designed to impersonate videoconferencing platforms like Zoom and Microsoft Teams. The phishing kit is used to compromise the victim's Telegram account, gain access to their contacts and chat histories, and secretly record them during the video chat.
The FaceStealer scheme has been linked to a campaign documented by Kaspersky under the name GhostCall in October 2025. The campaign is believed to be linked to a prolific North Korea-linked financially motivated threat cluster tracked as BlueNoroff, which is also known by the cryptonyms APT38, CageyChameleon, CryptoCore, DangerousPassword, Nickel Gladstone, Sapphire Sleet, Stardust Chollima, and UNC1069.
The North Korean hackers have also been using super intelligence (SI) to develop deepfake videos of well-known and influential individuals in the cryptocurrency and web3 industries. These deepfake videos are used to gain the trust of the target and build a rapport with them before presenting them with a link to install malware.
The FaceStealer scheme has been used to target individuals in the cryptocurrency and Web3 industries, as well as individuals involved in the development and maintenance of open-source software. The goal of the scheme is to obtain access to the developers' devices and the software repository accounts they control to facilitate software supply chain attacks.
In an extensive report shared with The Hacker News in July 2026, JUMPSEC revealed how the FaceStealer scheme is built atop a phishing kit designed to impersonate videoconferencing platforms. The phishing kit is used to hijack social media and communications accounts, and then accessing the victim's contact list to target the victim's personal and professional circles.
The entire attack plays out as follows:
Compromise a victim: This involves harvesting cryptocurrency wallets, seed phrases, and other valuable access; hijacking their Telegram account or other communication app and locking them out; gaining access to their contacts and chat histories; and secretly recording them during the video chat.
Exploit the victim's Telegram account: The attacker impersonates the victim and sends tailored messages to other contacts on their behalf, proposing a Zoom or Teams meeting under the pretext of discussing an investment opportunity.
Set up the meeting: Should the target express interest, the attacker sends a Calendly invite via Telegram to schedule the video meeting. Shortly before the scheduled meeting time, the victim's Telegram account is used to send a typosquatted link that masquerades as a meeting URL for Zoom or Teams.
Exploit recorded videos: When the target joins the fake Zoom meeting, the attacker plays an already recorded webcam video of the trusted contact and plays other videos, either recorded or deepfake videos, to give the impression that there are multiple participants in the meeting. In addition, headshot images generated using OpenAI ChatGPT are used as static avatar placeholders on the fake calls.
Trick the target into infecting themselves: The attacker sends a message to the target, claiming there is an audio issue or some other technical error, and urges them to click on a link to apply an update to address the problem. Alternatively, it can take the form of running a script or copying and pasting malicious code into the command line or Terminal. This results in the deployment of malware that can capture sensitive data from the compromised device, effectively turning the target into the next victim.
Repeat the cycle: With the victim now compromised, the attacker gains control of their device and social media accounts to propagate the attack to their contacts.
The FBI has also announced that the cloud-based infrastructure used to pull off the FaceStealer scheme has been seized. In tandem, the U.S. Department of Justice (DoJ) has announced the court-authorized seizure and restraint of more than $1.2 billion worth of cryptocurrency recently stolen by the North Korea-linked TraderTraitor actors following the hack of cryptocurrency exchange Binance.
The plundered digital assets are used to fund Pyongyang's illicit weapons program, the DoJ added. "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," said FBI Cyber Branch Operations Director Brett Leatherman in a statement.
North Korean cyber actors have used the FaceStealer scheme to aggressively target individuals in the cryptocurrency and Web3 sectors through deceptive social engineering tactics, resulting in the theft of more than $400 million in the last 18 months.
According to the Justice Department, FaceStealer relies on surreptitiously recorded videos and deepfakes to facilitate cryptocurrency theft. Some aspects of the activity dovetail with a campaign documented by Kaspersky under the name GhostCall in October 2025.
The activity is linked to a prolific North Korea-linked financially motivated threat cluster tracked as BlueNoroff, which is also known by the cryptonyms APT38, CageyChameleon, CryptoCore, DangerousPassword, Nickel Gladstone, Sapphire Sleet, Stardust Chollima, and UNC1069.
The campaign involves luring targets with invitations to video meetings delivered from stolen accounts belonging to prior victims. Targets who join the meeting have their video stream recorded, while simultaneously serving an authentic, prerecorded webcam video of a previous victim or victims known to the target to build trust.
"The North Korean hackers also use super intelligence (SI) to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries that make the FaceStealer scheme even more effective," the DoJ said. "Here again, they use the deepfake videos in the meetings with targets to gain the target's trust."
A few seconds into the meeting, a mock technical error is presented to the victim, claiming that they cannot be heard, and they are provided a link to address the non-existent issue. The fix is a ClickFix-style lure that's designed to install malware on the victim's workstation and steal cryptocurrency, as well as abuse the target's privileges to other computer infrastructure.
In an extensive report shared with The Hacker News in July 2026, JUMPSEC revealed how the social engineering operation is built atop a phishing kit designed to impersonate videoconferencing platforms. The phishing kit is used to hijack social media and communications accounts, and then accessing the victim's contact list to target the victim's personal and professional circles.
The cybersecurity company has characterized FaceStealer as a victim acquisition platform that involves using compromised trusted contacts as a pathway to fuel a self-propagating attack chain via Telegram.
This includes hijacking social media and communications accounts such as Telegram, LinkedIn, Slack, and Discord for extended periods of time, and then accessing the victim's contact list to target the victim's personal and professional circles.
The entire attack plays out as follows:
Compromise a victim: This involves harvesting cryptocurrency wallets, seed phrases, and other valuable access; hijacking their Telegram account or other communication app and locking them out; gaining access to their contacts and chat histories; and secretly recording them during the video chat.
Exploit the victim's Telegram account: The attacker impersonates the victim and sends tailored messages to other contacts on their behalf, proposing a Zoom or Teams meeting under the pretext of discussing an investment opportunity.
Set up the meeting: Should the target express interest, the attacker sends a Calendly invite via Telegram to schedule the video meeting. Shortly before the scheduled meeting time, the victim's Telegram account is used to send a typosquatted link that masquerades as a meeting URL for Zoom or Teams.
Exploit recorded videos: When the target joins the fake Zoom meeting, the attacker plays an already recorded webcam video of the trusted contact and plays other videos, either recorded or deepfake videos, to give the impression that there are multiple participants in the meeting. In addition, headshot images generated using OpenAI ChatGPT are used as static avatar placeholders on the fake calls.
Trick the target into infecting themselves: The attacker sends a message to the target, claiming there is an audio issue or some other technical error, and urges them to click on a link to apply an update to address the problem. Alternatively, it can take the form of running a script or copying and pasting malicious code into the command line or Terminal. This results in the deployment of malware that can capture sensitive data from the compromised device, effectively turning the target into the next victim.
Repeat the cycle: With the victim now compromised, the attacker gains control of their device and social media accounts to propagate the attack to their contacts.
Attacks mounted by BlueNoroff are known to specifically single out individuals working in the cryptocurrency and Web3 industries, along with individuals involved in the development and maintenance of open-source software.
The goal is to obtain access to the developers' devices and the software repository accounts they control to facilitate software supply chain attacks.
Notably, the FaceStealer scheme was put to use in targeting the maintainer of the popular Axios npm package earlier this year to push a trojanized version that delivered a cross-platform remote access trojan (RAT).
More than 900 victim webcam video recordings used by the threat actors to impersonate victims in follow-on attacks have been seized by the FBI. The agency said it's "aware of several other attempts by North Korean hackers to target software developers, maintainers, and software libraries with significant download volume."
In a report published in April 2026, Arctic Wolf said the targeted social engineering campaign had targeted over 400 victims across more than 20 countries, with most of them concentrated in the U.S., Singapore, the U.K., Hong Kong, South Korea, and the U.A.E.
Deepfake video production pipeline (credit: Arctic Wolf)
"A full 80% of identified targets operate directly in cryptocurrency/blockchain finance (54%) or adjacent finance and investment sectors (26%)," the cybersecurity company noted. "CEOs and founders alone account for 45% of the target set – nearly half. This underscores BlueNoroff's singular operational focus: individuals with access to cryptocurrency assets, wallet infrastructure, exchange platforms, or investment decision-making authority."
The activity has since expanded in scope, with 677 targets identified across 58 countries. More than 80% of the targets are founders and C-suite executives. Besides introducing new lure themes such as a fake Chrome PDF Viewer update, the campaign incorporates generative AI technology from ChatGPT, Google, SpaceXAI Grok, and Wondershare AI Content Generator (AIGC) to supply the attackers with artwork, avatars, and convincing synthetic participant videos.
"Upstream, reconnaissance has both widened and become more deliberate," the company added. "Lure material has been scraped not just from profile photos and prior victims' webcam streams, but from YouTube interviews and conference talks, which are screen-recorded by the actor. This allows them to capture a specific person's likeness and voice – a founder perhaps, or a CEO – and then create fake meeting footage without having to directly compromise the target themselves."
The cyclic modus operandi still remains the beating heart of the social engineering operation.
"Combined with their new fake media generation capabilities to produce varied and credible lure content, this presents a significant escalation in BlueNoroff's efforts to compromise high-value individuals who control funds, signing keys, sensitive information, authenticated communications, and trusted professional relationships," Arctic Wolf said.
Related Information:
https://www.ethicalhackingnews.com/articles/FBI-Uncovers-Sophisticated-North-Korean-Cryptocurrency-Heist-Using-Deepfake-Video-Calls-ehn.shtml
https://thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html
Published: Fri Nov 13 11:09:41 2026 by llama3.2 3B Q4_K_M
