The US government has disrupted a North Korean FaceStealer social engineering campaign that stole more than $400 million in cryptocurrency, and the tactics apply to any business.
BleepingComputer reported the disruption, drawing on an FBI alert and a joint FBI and Department of Justice announcement from November 2026. The underlying FBI page on the FaceStealer Cryptocurrency Theft Scheme is the primary source, and it is worth reading directly. While the immediate victims were cryptocurrency and Web3 companies and open-source developers, the technique itself, hijacked trust, fake video meetings, and a malicious "fix," is a blueprint that works against any organization where one convincing conversation can unlock systems, credentials, or money.
Key Takeaways
- The FBI and DOJ disrupted cloud-based infrastructure behind a North Korean scheme called FaceStealer, which stole more than $400 million in cryptocurrency over the last 18 months before the seizure.
- The FBI identified and seized over 900 webcam videos of victims working in the crypto and Web3 industries, recorded secretly during compromised video meetings and reused against new targets.
- The attack chain runs from hijacked accounts on Telegram, LinkedIn, Slack, and Discord, to imposter video calls featuring recorded footage of people the target knows, to a fake error message and a malicious "fix" delivered as a link.
- The FBI attributes the activity to a North Korean group known in the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff. ArcticWolf researchers identified 677 targets across 58 countries, with a heavy focus on company founders and senior executives.
- The scheme increasingly targets open-source developers and maintainers to reach the software supply chain, including a compromised maintainer of a popular JavaScript library with tens of millions of weekly downloads.
What happened: the facts in detail
The disruption
In November 2026, the FBI and DOJ announced the disruption of cloud-based infrastructure used by North Korean hackers in this scheme. BleepingComputer reported that the FaceStealer campaign ran for 18 months before US authorities seized the underlying infrastructure. Leading up to the disruption, the scheme had resulted in the theft of more than $400 million in the last 18 months, according to the FBI.
The FBI also identified and seized over 900 webcam videos of victims working in the crypto and Web3 industries around the world. These recordings were not incidental byproducts. They were operational material, captured to make the next round of attacks more convincing.
Who is behind it
The FBI attributes this activity to a North Korean hacking group commonly referred to in the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff. Private-sector researchers reached the same attribution from different angles. ArcticWolf researchers attributed the campaign to BlueNoroff and listed additional lures, including financial documents, fake PDF viewer updates, identity verification prompts, and security audits. Huntress attributed a similar campaign to BlueNoroff in 2025, in which attackers used Zoom calls to infect company executives with custom macOS malware. Amazon threat analysts attributed several open-source software supply chain attacks to BlueNoroff in a July 2026 report.
ArcticWolf researchers identified 677 targets across 58 countries, with a heavy focus on company founders and senior executives. That targeting profile matters: this is not opportunistic phishing at scale. It is a curated campaign aimed at people whose compromise yields the most value.
How the attacks unfolded
According to the FBI alert, the threat actor hijacked accounts on Telegram, LinkedIn, Slack, and Discord, and used them to invite victims to video meetings under various pretenses. The hijacked accounts are the first trust lever: the invitation appears to come from a real person the target may know.
During the video calls, the attacker showed recorded footage of people the targets knew, people who had previously fallen victim themselves. The FBI explains the recycling mechanism: while a target waited for the meeting to start, the hacker secretly recorded a video of that target, which was later used with other victims. Some meetings featured recordings of multiple familiar individuals, adding pressure on the current victim in the next stage.
Shortly after, the hacker claimed a technical issue and displayed a fake error message to justify delivering a malicious "fix." The target was prompted to follow a link that purported to offer a fix, such as an update or installer. That link infected the victim's computer with malware that steals crypto data and account credentials for video meeting platforms such as Zoom, Google Meet, and Microsoft Teams. The malware also provides access to victims' contact lists, social media, communication apps, and webcam videos.
One detail deserves particular attention from any executive: according to the FBI, attackers sometimes delayed targeting individuals for months or even more than a year after the initial compromise, likely waiting for their cryptocurrency holdings to grow. A compromise today can be monetized long after the victim has forgotten the meeting that started it.
The open-source dimension
The FBI's page on the scheme states that these actors are increasingly targeting open-source software developers and maintainers using the FaceStealer technique to gain access to their devices and software repository accounts, with the objective of compromising the software supply chain. By infiltrating accounts of trusted developers and maintainers, the threat actors can potentially distribute malicious code through widely used software, impacting millions of downstream users.
The FBI bulletin highlighted an incident in which the hackers compromised the maintainer of a popular open-source JavaScript library with tens of millions of weekly downloads, after luring them into a fake Teams meeting with multiple participants, including one familiar to the developer. The attack was thwarted thanks to quick detection. The FBI also confirmed multiple other attempts against developers in the npm and Rust crate ecosystems.
In a separate announcement, the DOJ said that together with private sector companies, the US government froze more than $2.7 billion from the 6.4 billion Binance crypto heist, and has obtained court authorization to seize or restrain in excess of $1.2 billion of that amount.
FaceStealer social engineering: how it works and why it matters technically
The FBI describes FaceStealer as a highly effective social engineering scheme that uses imposter versions of popular video conferencing platforms, secretly recorded webcam video, and computer intrusions. The FBI lays out the kill chain in five steps: compromise and secretly record a victim's webcam; hijack the victim's communication accounts and message the victim's contacts; deliver a convincing fake video link to a new target; lure the target into a realistic imposter video chat; then impersonate the original victim with recorded webcam video and trick the target into self-infection.
Three technical properties make this chain unusually dangerous.
First, it is self-propagating through trust. Each victim becomes raw material for the next attack. The malware harvests contact lists and communication apps, and the webcam recording becomes a deepfake-adjacent asset: not a synthetic face, but a real one, captured under conditions where the victim believed they were simply waiting for a meeting to start. BleepingComputer notes the attacks used multiple social engineering techniques, including deepfakes and ClickFix. The ClickFix pattern, a fake error followed by an instruction to run a "fix," converts a moment of mild frustration into a user-initiated infection. The user runs the malicious payload themselves, which can bypass assumptions baked into many endpoint controls that something malicious arrived from outside.
Second, it compounds. The malware steals credentials for the very platforms used to conduct the next meeting, Zoom, Google Meet, and Microsoft Teams, along with contact lists and social media. Compromise of one person enlarges the attacker's reach into that person's entire professional network. The months-long delay before monetization that the FBI describes means the intrusion window and the loss window are decoupled, which defeats the common instinct that no incident occurred because nothing was stolen immediately.
Third, it aims upstream. The targeting of open-source maintainers is not about the maintainer's own assets. It is about the trust embedded in software repositories. A maintainer's account is a distribution channel to every downstream user of that package. The FBI's reference to a JavaScript library with tens of millions of weekly downloads illustrates the use: one convincing video call can theoretically place malicious code into build pipelines worldwide. For regulated businesses, this reframes vendor and dependency risk. Your exposure is not limited to who you email; it extends to whose code you run.
For a business reader, the practical significance is that FaceStealer defeats the two checks most people rely on: "I can see them" and "I know them." Recorded video of a familiar colleague satisfies the first check. A hijacked account from a real contact satisfies the second. Neither verifies what it appears to verify. This is the same underlying shift we examined in our analysis of AI-Powered Social Engineering Attacks, where synthetic media and cloned voices erode the reliability of sensory verification, and in our piece on AI vs. Social Engineering: Threats and Defenses.
What the evidence does and does not show
The core facts here are well sourced. The FBI's own page, the FBI alert referenced by BleepingComputer, and the DOJ announcement establish the disruption, the seizure of over 900 webcam videos, the $400 million theft figure over the last 18 months, and the attribution to the group known as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff. The 677 targets across 58 countries figure comes from ArcticWolf researchers, not from the FBI, and should be read as private-sector telemetry that may not capture the full scope of the campaign.
Several important questions remain open, and the sources do not answer them.
The sources do not identify the specific victims by name, beyond the anonymous open-source maintainer whose attack was thwarted. They do not say how many organizations were successfully compromised, how many of the 677 identified targets were actually attacked, or what fraction of the $400 million has been recovered. The BleepingComputer report notes the separate DOJ action freezing more than $2.7 billion from the 6.4 billion Binance crypto heist, but does not state that any FaceStealer proceeds were recovered in that action.
The exact malware families deployed are not named in these sources, and the sources do not describe the specific cloud infrastructure that was seized, who operated it, or where it was hosted. The FBI's page directs readers to a FLASH advisory for best practices, but the advisory itself is not among the materials reviewed here, so any detail attributed only to that document cannot be verified from this reporting.
Attribution also deserves a caveat. The FBI lists five private-sector names for the group, which reflects how threat intelligence firms track overlapping activity rather than a single settled identity. The ArcticWolf, Huntress, and Amazon attributions to BlueNoroff are consistent with the FBI's view, but they are independent analyses, and the sources do not describe the evidence behind them.
Finally, the open-source supply chain risk is stated by the FBI as an objective and a demonstrated attempt pattern, with one thwarted incident and multiple confirmed attempts against npm and Rust crate developers. The sources do not document a completed, successful supply chain compromise through this campaign. The absence of a confirmed downstream breach is not evidence of safety; it is a limit of what has been publicly reported.
What the evidence does support, clearly, is the FBI's own framing: these actors aggressively target companies and individuals in the cryptocurrency and Web3 industries with highly tailored, hard-to-detect social engineering campaigns, and they are expanding toward open-source developers. Organizations that assume their industry places them outside this threat's crosshairs should note that the technique, hijacked trust plus a fake video meeting plus a malicious fix, does not depend on the victim holding cryptocurrency. It depends on the victim being reachable through someone they trust, which describes nearly every organization. For context on how social engineering plays out in regulated environments, see our coverage of cyber security risks and our related analysis of the Clover Health social engineering incident. In Part 2, we will look at what this means for regulated businesses and the specific defenses the FBI recommends, including joining meetings only through official apps using an invite code, verifying unexpected invitations independently, keeping the webcam off unless explicitly needed, and never running scripts offered as fixes.
Compliance and Risk Implications for Regulated Organizations
Nothing in the FaceStealer story involves a cryptocurrency exchange, and that is precisely why it matters to regulated businesses. The technique is portable. A social engineering scheme that hijacks communication accounts, stages convincing imposter video calls, and delivers malware through a fake "fix" works just as well against a defense contractor's program manager, a healthcare revenue cycle director, or a law firm partner as it does against a Web3 founder. The FBI's own description of the scheme makes no sector-specific assumptions about the victims; it describes a repeatable attack chain built on trust in familiar faces and urgency around technical problems (https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme).
For organizations subject to federal contract requirements, the incident maps directly onto existing obligations. NIST SP 800-171's Incident Response family requires an operational incident handling capability and the tracking, documenting, and reporting of incidents. A scheme like this one, which hands attackers credentials, contact lists, and webcam access, is exactly the kind of incident that triggers those requirements. DFARS 252.204-7012 requires reporting a cyber incident affecting covered defense information to DoD within 72 hours of discovery via dibnet.dod.mil, using a DoD-approved medium assurance certificate obtained in advance. After a reported incident, affected system images and monitoring data must be preserved for at least 90 days. An organization that discovers a FaceStealer-style compromise and has no incident response plan, no forensic preservation practice, and no pre-obtained reporting certificate will fail those requirements at the worst possible moment.
Healthcare organizations face a parallel structure of duties. The HIPAA Breach Notification Rule, at 45 CFR 164.404, 164.406, and 164.408, imposes notification obligations when unsecured protected health information is breached. Malware that steals account credentials and provides access to communication platforms and contact lists can absolutely put PHI in scope, particularly where those platforms carry clinical or patient communications. The FBI's finding that attackers sometimes waited months, or more than a year, after an initial compromise before acting adds a compliance wrinkle: a dormant compromise discovered late still counts as discovery for notification purposes, and the clock does not wait for a tidy investigation.
There is also a supply chain dimension that regulators are watching closely. The FBI states that these actors are increasingly targeting open-source software developers and maintainers to gain access to their devices and software repository accounts, with the objective of compromising the software supply chain and potentially distributing malicious code through widely used software (https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme). The FBI confirmed multiple other attempts against developers in the npm and Rust crate ecosystems beyond the one incident it highlighted. Any regulated organization that builds software, or depends on vendors who do, inherits that risk through its dependency tree. CISA's Cross-Sector Cybersecurity Performance Goals 2.0 exist precisely to give small and medium organizations a prioritized baseline against risks of this kind (https://www.cisa.gov/cross-sector-cybersecurity-performance-goals), and NIST SP 800-61 Rev. 3 frames incident response as something to prepare for before an incident, not improvise during one (https://csrc.nist.gov/pubs/sp/800/61/r3/final).
What This Means for Regulated Industries
Defense Contractors
The supply chain angle deserves the most attention here. If North Korean actors can compromise a maintainer of a JavaScript library with tens of millions of weekly downloads, they can attempt the same approach against developers working on defense software, and the FBI says it confirmed attempts against open-source ecosystems broadly. Contractors handling CUI should treat third-party and open-source code intake as an attack surface, not a procurement afterthought. The DFARS 252.204-7012 reporting duty applies if covered defense information is affected, so the practical question is whether your team could even recognize a FaceStealer-style compromise as reportable within 72 hours. That requires trained staff, a documented incident response plan aligned to NIST SP 800-171, and monitoring that would catch credential theft on communication platforms. Contractors preparing for CMMC assessments should also expect assessors to probe whether social engineering is addressed in training and whether the incident response plan has ever been exercised.
Healthcare
Healthcare organizations are not cryptocurrency targets, but they are credential-rich targets, and the FaceStealer chain ends in credential theft. Malware that harvests Zoom, Google Meet, and Microsoft Teams credentials, plus contact lists and social media access, gives an attacker everything needed for a follow-on intrusion into email and cloud environments where PHI lives. HHS-reported breach data shows business associates accounted for about 66% of breached healthcare records in 2024, which means your vendor's video call compromise can become your breach notification obligation. The IBM 2026 Cost of a Data Breach report puts the average healthcare breach at $6.64 million. Verify that your business associates have credible incident response capability, and confirm your own breach assessment workflow can distinguish a compromised communication account from a reportable breach of unsecured PHI under 45 CFR 164.404 through 164.408.
Legal
Law firms concentrate exactly what this scheme hunts for: privileged communications, client contact lists, and senior professionals accustomed to joining video calls arranged by people they know. The FBI describes attackers hijacking accounts on Telegram, LinkedIn, Slack, and Discord and using them to invite victims to video meetings under various pretenses, then displaying fake error messages to justify delivering a malicious fix. A partner who receives a "your meeting client is out of date" prompt is under real social pressure to click. Firms handling client data under confidentiality obligations should extend their security awareness programs to cover imposter video meetings specifically, and should treat any request to run an installer or script to "fix" a meeting problem as a reportable security event, not an IT nuisance.
Financial Services
Financial firms sit closest to the original target profile, especially any firm with digital asset exposure, treasury operations touching crypto, or fintech vendors in the stack. The FaceStealer malware steals crypto data directly, and the FBI attributes the campaign to actors the private sector calls BlueNoroff, Sapphire Sleet, UNC1069, Stardust Chollima, and APT38. Even firms with no crypto exposure should note the campaign's patience: attackers sometimes delayed action for months or more than a year after compromise, waiting for holdings to grow. That latency defeats point-in-time security reviews and argues for continuous monitoring of communication platform accounts, not annual attestations. Firms subject to GLBA-aligned safeguards or state financial privacy laws should map this attack chain against their existing controls and document the gaps.
A Practical Action Plan for This Month
- Brief your workforce on the exact scheme. Circulate the FBI's description of the FaceStealer chain, including the fake error message and malicious "fix" pattern, so staff recognize it on sight (https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme).
- Set a hard rule on meeting joins. Require everyone to join meetings only through official applications using an invite code, never through a downloaded installer or update prompted by a meeting error.
- Ban "fix" scripts and installers. Tell staff that no legitimate meeting platform requires running a script, update, or installer mid-call, and that any such prompt should be reported to security immediately.
- Verify unexpected invitations independently. Establish a verification step for unexpected meeting invites from known contacts, using a separate channel such as a known phone number.
- Default webcams off. Adopt the FBI's recommendation to keep the webcam off unless explicitly needed, which removes the raw material for the recorded-video impersonation technique.
- Audit privileged access to communication platforms. Review who holds admin rights in Microsoft 365, Slack, and similar tools, and enforce MFA so a stolen password alone does not yield account takeover.
- Exercise the incident response plan against this scenario. Walk through a hypothetical compromise involving stolen meeting credentials and confirm your team knows the DFARS 72-hour reporting path, evidence preservation for at least 90 days, and HIPAA breach assessment steps that apply to you.
- Obtain reporting credentials in advance. If you are a defense contractor, secure the DoD-approved medium assurance certificate needed to file a DFARS 252.204-7012 report before you need it.
- Review your software supply chain intake. Inventory critical open-source dependencies and confirm you can respond if a maintainer account you rely on is compromised.
- Confirm monitoring covers communication platforms. Verify your detection stack watches for unusual meeting activity, impossible travel, and suspicious API activity across Microsoft 365, Azure, AWS, and Google Workspace.
How Petronella Technology Group, Inc. Helps
Petronella Technology Group, Inc. provides managed security services with 24/7 monitoring, threat detection, and incident response through an outsourced security operations center, including Managed Detection and Response that combines 24/7 threat monitoring, AI-powered analytics, and human-led investigation. Cloud coverage integrates Microsoft 365, Azure, AWS, and Google Workspace to detect unauthorized access, configuration drift, impossible travel, and suspicious API activity, which is the kind of telemetry that would surface a hijacked communication account or a dormant compromise. Onboarding moves from agent deployment in 1 to 2 weeks through behavioral baselining to full MDR coverage with tuned detection operational within 30 days of contract signing.
Our AI-augmented hybrid SOC runs ten-plus production AI agents on the company's private AI cluster, with human analysts holding CMMC-RP credentials and a Digital Forensics Examiner on staff. The AI never closes a ticket on its own, never touches production systems without human authorization, and every action is logged for CMMC and HIPAA audit. The private AI cluster and 24/7 hybrid analysis stack serve defense industrial base and healthcare clients that cannot send CUI or PHI to a public-cloud SOC.
On the compliance side, our compliance practice builds and maintains the programs this incident tests: incident response plans aligned to NIST SP 800-171, DFARS 252.204-7012 reporting readiness including advance certificate acquisition, and HIPAA Security Rule documentation aligned to NIST SP 800-66 Rev 2 and the HHS Office for Civil Rights audit protocol. For defense contractors, our CMMC readiness work delivers an SSP covering all 110 NIST SP 800-171 controls, 14 control-family policies including an incident response plan, and a live POA&M. Broader cybersecurity services deploy a 39+ layer security stack covering People, Process, and Technology.
We also publish analysis on the evolving social engineering threat, including AI-powered social engineering attacks and how AI is reshaping both attacks and defenses, and we work with engineering organizations through resources such as our guidance for engineering firms on IT, CMMC, and private AI.
Related reading
- Cyber Incident Response Plan Guide
- AI-Powered Social Engineering Attacks
- North Korean Hackers Posed as Recruiters to Infect 30,000 Devices
- Bitget Resumes Bitcoin Withdrawals After Major Crypto Heist
- ShadowGate Crypto Malware: Bitcoin Ransom Lockdowns
Sources
- US disrupts North Korean campaign behind $400 million crypto theft
- FaceStealer Cryptocurrency Theft Scheme
- Patching That Just Works
- Book a Demo for AI Agent Identity Security
- Cross-Sector Cybersecurity Performance Goals
- SP 800-61 Rev. 3, Incident Response Recommendations and Considerations for Cybersecurity R
Frequently Asked Questions
What is the FaceStealer social engineering scheme?
FaceStealer is a North Korean social engineering scheme that uses imposter versions of popular video conferencing platforms, secretly recorded webcam video, and computer intrusions to steal cryptocurrency. Attackers hijack communication accounts, lure targets into fake video meetings featuring recordings of people the target knows, then display a fake error message and trick the target into running a malicious "fix" that steals credentials and crypto data.
How much cryptocurrency did the FaceStealer campaign steal?
The FBI states the scheme resulted in the theft of more than $400 million in the last 18 months leading up to the disruption. The FBI also notes that North Korean actors targeting the crypto and Web3 industries have stolen billions of dollars in cryptocurrency in recent years across their campaigns.
Who is behind the FaceStealer attacks?
The FBI attributes the activity to a North Korean hacking group referred to in the private sector as Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff. ArticWolf researchers attributed the campaign to BlueNoroff, and Huntress attributed a similar 2025 campaign using Zoom calls and custom macOS malware to the same group.
Was the FaceStealer infrastructure actually disrupted?
Yes. In November 2026, the FBI and DOJ announced the disruption of cloud-based infrastructure used by North Korean hackers in this scheme, after the campaign ran for 18 months. The FBI identified and seized over 900 webcam videos of victims working in the crypto and Web3 industries around the world.
Why should a business outside crypto care about this story?
Because the attack chain is not crypto-specific. It exploits trust in familiar faces on video calls and urgency around technical problems, both of which exist in every industry. The malware harvests credentials for Zoom, Google Meet, and Microsoft Teams, along with contact lists and social media access, which is a starting point for intrusion into any organization's cloud environment.
How do I protect my organization from a FaceStealer-style attack?
Follow the FBI's recommendations: join meetings only through official apps using an invite code, verify unexpected invitations independently, keep the webcam off unless explicitly needed, and never run scripts offered as fixes to technical problems. Pair those user-level rules with MFA on communication platforms, 24/7 monitoring of cloud and communication accounts, and a tested incident response plan.
If this story raised questions about your organization's exposure, call Penny, our AI assistant, at 919-348-4912 to book a consultation, or reach Petronella Technology Group, Inc. through our contact form.
Online course from the Petronella Technology Group, Inc. Training Academy
Cryptocurrency Self-Custody Mastery
Master crypto self-custody in this 24+ hour course.
Price: $499
Free, practical, and specific to regulated environments. We will email it to you.
No spam. Unsubscribe anytime.
