Abstract:
The FBI said that a North Korean state-backed hacker group has stolen more than $400 million worth of cryptocurrency in the past 18 months through a sophisticated social engineering attack called "FaceStealer." These attackers use a familiar persona of the victim to fake a video conference, trick the target into installing malware, and then expand the scope of the attack through compromised devices and social networks.
According to a Reuters report on November 12, 2026, the FBI disclosed that this attack system does not simply steal passwords through phishing emails or malicious websites, but combines social accounts of real people, secretly recorded videos, and deep fake images generated by artificial intelligence, making the victims mistakenly believe that they are communicating normally with trusted colleagues, friends, or industry insiders.
An attack often begins with a seemingly believable video conference invitation. Hackers first invade a target person's social media or instant messaging account, obtain their contact information and past communication records, and then use the stolen account to send meeting invitations to the victim. Since the invitation comes from a real contact and the content of the message is consistent with the past communication habits of both parties, the target will often not generate too much suspicion.
After clicking the link, the victim will enter a website that imitates mainstream video conferencing software such as Zoom, Microsoft Teams or Google Meet. A person familiar to the victim may appear in the meeting, but it is actually a video recorded by the attacker in advance. Hackers may even arrange for multiple, authentic-looking attendees to enhance the credibility of the entire meeting.
During the meeting, the attacker will deliberately cause technical glitches, such as claiming that the victim cannot be heard, and then prompt the other person to click on a link or perform certain actions to fix the audio problem. The so-called fix is actually malware, and once the victim follows the instructions, the malicious code is installed on their computer.
Once a device is compromised, hackers can steal passwords, take control of social media accounts, or gain access to other computer systems that the victim has access to. The attacker will further collect the victim's contacts, social media information and communication records, and then use this information to launch a new round of attacks on their relatives, friends, colleagues and business partners.
This means that every victim may become the entry point for the next round of attacks. Not only are hackers able to leverage the accounts and information gained from the initial breach, but they can also use the victim's true identity to establish new trust, making subsequent attacks more difficult to identify.
The FBI says attackers have begun using artificial intelligence to create deepfake videos of celebrities and important figures in the cryptocurrency industry. These fake images are used in video conferencing to further enhance the deception effect. The FBI seized more than 900 webcam videos of victims this time, showing that attackers are not only using pre-recorded images to impersonate others, but are also continuing to collect video material of new victims to provide material for subsequent attacks.
The U.S. Department of Justice called this operation the "FaceStealer" social engineering attack operation of the North Korean hacker group, and announced on November 12 that it had taken measures to seize the cloud infrastructure used by the relevant hackers. The United States claims that this action has caused more than $400 million in cryptocurrency losses in the past 18 months and also threatened the security of the open source software supply chain.
The FBI attributed the activities to the North Korean hacker group Sapphire Sleet, also known as UNC1069. The organization has also been tracked by security research agencies using names such as Dangerous Password, CryptoCore, and BlueNoroff. The United States pointed out that these attackers are gradually expanding their targets from cryptocurrency holders to open source software developers and maintainers, trying to invade their personal devices and software warehouse accounts.
This change is particularly noteworthy. Open source software is often used by a large number of enterprises and developers to build their own applications. If an attacker can control the maintainer account of an important project, it is possible to insert malicious content into software updates or code submissions, thereby affecting downstream users. The FBI believes that attacks on the open source software supply chain may be an important new direction of this operation.
A case announced by the U.S. Department of Justice showed that earlier this year, a developer responsible for maintaining a JavaScript software library participated in a fake Teams meeting. A person known to the developer appeared in the meeting, who then asked him to perform repair operations due to audio glitches, which ultimately led to the developer's computer being infected. The attacker attempts to gain access to the software warehouse account he controls and create further supply chain risks. The related attacks were eventually discovered and blocked, without causing widespread spread.
The U.S. Department of Justice also emphasized that the FaceStealer operation was a different hacking operation from the recent huge theft incident against the cryptocurrency exchange Binance. The latter involves a North Korean hacking group known to the United States as Trader Traitor. The FBI has previously attributed the Binance theft to this organization, while FaceStealer was mainly implemented by hacker activity clusters such as Sapphire Sleet. The two should not be confused.
North Korea has a long history of using cryptocurrency theft to fund government activities and sanctioned weapons programs, the U.S. Department of Justice said. The seizure was intended to disrupt FaceStealer’s technical infrastructure and serve as a reminder to the cryptocurrency and open source software industries to be more vigilant.
This incident also shows that artificial intelligence and deepfake technology are changing the way cybercrime attacks. In the past, the image of acquaintances in video conferences often became an important basis for identity verification, but now, hackers can create extremely confusing false scenes by stealing real accounts, recording images of real people, and generating AI deep fake videos. For enterprises and developers, relying solely on video footage, familiar avatars, or meeting invitations from acquaintances’ accounts is no longer enough to confirm the other party’s identity.
Comments