The United States Federal Bureau of Investigation (FBI) has revealed that North Korean-linked hackers stole more than $400 million worth of cryptocurrency over the past 18 months through a sophisticated social engineering operation involving deepfake videos and fake online meetings.

The campaign, identified as FaceStealer, targets individuals and organisations operating in the cryptocurrency and Web3 industries by impersonating trusted contacts and influential figures during fraudulent video conferences.

As part of a coordinated operation announced by the US government, authorities have seized cloud-based infrastructure allegedly used by the hackers to execute the campaign.

The US Department of Justice (DoJ) also disclosed that it had obtained court authorisation to seize and restrain more than $1.2 billion in cryptocurrency recently stolen by North Korean-linked TraderTraitor hackers following an attack on cryptocurrency exchange Binance.

According to the department, proceeds from large-scale cryptocurrency thefts are used to finance North Korea’s illicit weapons development programme.

FBI Cyber Branch Operations Director Brett Leatherman said North Korean hackers had increasingly relied on cryptocurrency theft to generate funds for the country’s weapons programme.

He explained that the FaceStealer operation had aggressively targeted people working in cryptocurrency and Web3 through deceptive social engineering techniques, resulting in losses exceeding $400 million within 18 months.

The Justice Department said the operation uses secretly recorded webcam videos and artificially generated deepfake footage to deceive victims. Some elements of the campaign are similar to an operation documented by cybersecurity company Kaspersky in October 2025 under the name GhostCall.

Investigators have linked FaceStealer to BlueNoroff, a financially motivated North Korean cyber threat group also tracked under several other names, including APT38, CryptoCore, Sapphire Sleet, Stardust Chollima and UNC1069.

How the FaceStealer Operation Works

The attackers typically begin by sending invitations to online meetings through compromised accounts belonging to people the intended victims already know and trust.

When a target accepts the invitation, the attackers record the victim’s webcam footage while simultaneously playing prerecorded videos of familiar individuals to make the meeting appear genuine.

The hackers also use artificial intelligence to generate deepfake videos of prominent personalities, particularly influential figures in the cryptocurrency and Web3 industries.

The Justice Department said these fabricated appearances help the attackers establish credibility and gain the confidence of their targets.

Once the meeting begins, the victim is deliberately confronted with a fake technical problem. They may be told that their microphone is not working or that a software component requires an update.

The attackers then provide a link supposedly designed to resolve the problem. Instead, the link launches a ClickFix-style social engineering technique intended to trick the victim into installing malware on their computer.

The malicious software can steal cryptocurrency-related information, capture sensitive data and provide attackers with access to other systems and accounts controlled by the victim.

A detailed investigation published by cybersecurity firm JUMPSEC in July 2026 revealed that FaceStealer operates through phishing infrastructure designed to imitate popular video conferencing services such as Zoom and Microsoft Teams.

The researchers described the operation as a victim-acquisition platform that uses compromised trusted contacts to spread the attack through Telegram and other communication channels.

Once an account is compromised, the hackers can maintain access to platforms such as Telegram, LinkedIn, Slack and Discord for extended periods. They then exploit the victim’s contact lists and conversations to identify additional targets within their professional and personal networks.

The attack generally follows a recurring pattern.

First, hackers compromise an individual by stealing cryptocurrency wallet information, seed phrases and other valuable credentials. They may also hijack the victim’s Telegram or other communication accounts, lock the legitimate owner out and secretly record them during video calls.

The attackers subsequently use the compromised account to impersonate the victim and contact their associates with personalised messages proposing online meetings, often under the pretext of discussing investment opportunities.

If the recipient shows interest, the hackers send a scheduling invitation, sometimes through Calendly. Shortly before the meeting, they distribute fraudulent links designed to resemble legitimate Zoom or Microsoft Teams meeting addresses.

When the target joins the fake conference, prerecorded webcam footage of the trusted contact is played. Additional recorded or AI-generated videos are used to create the impression that other participants are also attending.

The attackers may also use AI-generated profile photographs as static avatars to make the fraudulent meeting appear more convincing.

After establishing contact, they introduce a supposed technical issue and instruct the victim to download an update, execute a script or paste commands into their computer’s terminal.

Following the execution of the malicious instructions, malware is deployed to collect sensitive information and compromise the victim’s device.

The cycle then begins again, with the newly compromised account used to approach more contacts and expand the operation.

Cryptocurrency Executives and Software Developers Among Key Targets

BlueNoroff has consistently focused on individuals working in cryptocurrency, blockchain and Web3 businesses, as well as developers responsible for maintaining open-source software projects.

The attackers are particularly interested in gaining access to developers’ computers and software repository accounts, which could provide opportunities for broader software supply chain attacks.

FaceStealer was reportedly used earlier in 2026 to target the maintainer of the widely used Axios npm package. The attackers allegedly sought to distribute a trojanised version of the software capable of installing a cross-platform remote access trojan.

The FBI disclosed that it had seized more than 900 webcam recordings allegedly collected by the hackers and used to impersonate previous victims in subsequent attacks.

The agency also said it was aware of other attempts by North Korean hackers to target software developers, maintainers and widely downloaded software libraries.

A report published by cybersecurity firm Arctic Wolf in April 2026 estimated that the social engineering campaign had already targeted more than 400 individuals across over 20 countries.

The most heavily affected locations included the United States, Singapore, the United Kingdom, Hong Kong, South Korea and the United Arab Emirates.

The research indicated that approximately 80 per cent of identified targets worked directly in cryptocurrency and blockchain finance or related financial and investment sectors.

Chief executives and company founders accounted for 45 per cent of the targets, highlighting the group’s interest in individuals with access to digital assets, cryptocurrency infrastructure, exchange platforms and investment decisions.

The campaign has since expanded considerably, with Arctic Wolf identifying 677 targets across 58 countries.

More than 80 per cent of those targeted were founders and senior corporate executives.

The attackers have also expanded their deception techniques by introducing new lures, including fake Google Chrome PDF Viewer updates.

They reportedly use generative AI tools from ChatGPT, Google, SpaceXAI Grok and Wondershare AI Content Generator to produce convincing artwork, profile photographs, avatars and synthetic video participants.

Arctic Wolf said the hackers had also expanded their reconnaissance activities by collecting images and footage from social media profiles, previous victims’ webcam recordings, YouTube interviews and conference presentations.

This enables them to reproduce the appearance and voices of prominent individuals, including business founders and chief executives, without necessarily compromising those individuals’ accounts directly.

The cybersecurity company warned that the combination of expanded intelligence gathering and AI-generated media had significantly increased the group’s ability to deceive high-value targets with access to funds, signing keys, sensitive information and trusted professional relationships.

FaceStealer Operation Differs From Contagious Interview Attacks

Security researchers have also drawn attention to another North Korean-linked campaign known as ClickFake Interview, an offshoot of the Contagious Interview operation.

Although it uses similar ClickFix techniques, the campaign is separate from FaceStealer and primarily targets job seekers, particularly software developers, through fraudulent recruitment processes.

The attackers pose as recruiters on platforms such as LinkedIn and send applicants supposed technical assessments designed to make them download or execute malicious files.

Alina Krasavina, an engineering manager at Delivery Hero, recently described how she was approached by two fake recruiters on the same day in October 2026, with just 13 minutes between the contacts.

According to her account, the first recruiter sent a technical assessment packaged as a Next.js project containing 113 files. A backdoor had allegedly been concealed near the end of the project’s next.config.js file.

The second individual invited her to a video interview and instructed her to share her entire screen, download a software repository and execute its contents.

When she refused, the supposed interviewer insisted that running the project was a requirement for proceeding with the recruitment process.

Krasavina said she later contacted the recruiter to request an alternative interview format but was blocked approximately one minute afterwards.

She observed that the two approaches were designed differently: one relied heavily on malicious code hidden inside a project, while the other focused on manipulating the victim through direct human interaction.

A joint cybersecurity advisory issued in late September 2026 by agencies from Japan, the United States, Australia and Germany estimated that the broader Contagious Interview campaign had compromised at least 30,000 devices across 100 countries.

The attackers have experimented with several methods to persuade victims to execute malicious software.

These include hiding malware inside coding assignments, software repositories and packages presented as part of recruitment assessments.

They have also exploited Visual Studio Code configuration files, particularly tasks.json, to trigger malicious commands automatically when a project is opened in the development environment.

Another technique involves placing malicious scripts in Git hooks, including pre-commit and post-checkout files, allowing malware to execute when a developer commits code or changes branches.

The hackers have also distributed trojanised installers for macOS utility applications, using shell scripts to deliver malware known as OtterCookie.

Sophos Reports Malware Infection Through Fake Coding Assignment

Cybersecurity company Sophos disclosed last month that an employee’s corporate macOS computer was compromised in mid-September 2026 after the employee cloned a publicly available software repository presented as a job interview coding assignment.

The employee opened the repository as a workspace in Visual Studio Code, unknowingly triggering a malicious configuration.

Sophos explained that the repository contained a weaponised VS Code workspace settings file that replaced the editor’s integrated terminal profile.

Whenever a terminal was opened within the affected workspace, the modified profile silently downloaded and executed a multi-stage malware payload.

The malicious software included BeaverTail, a JavaScript-based loader used to deliver a Python backdoor known as InvisibleFerret. Both malware families have been linked to the Contagious Interview operation.

Sophos said the malware remained active in the computer’s memory for approximately 26 hours, from its execution on September 14, 2026, until the device was restarted the following day.

The company clarified that the incident did not affect its products, services, customer information or customer systems.

Hackers Create Fake Recruitment Company to Target Developers

Further research by cybersecurity firm JFrog has uncovered another tactic used by threat actors linked to the recruitment-themed campaign.

The hackers reportedly established a fictitious company called AccuraSoftHire, complete with a professional careers website, client testimonials, a LinkedIn page, job advertisements on mainstream recruitment platforms and supposedly verified recruiters.

The operation was designed to create the appearance of a legitimate recruitment business and persuade job applicants to download malicious software through a compromised take-home assignment and video verification process.

Guy Korolevski, a senior security researcher at JFrog Security Research, said the fraudulent recruitment operation was deliberately structured to pass the credibility checks people normally rely on when evaluating potential employers.

He noted that the presence of a professional website, LinkedIn account, mainstream job listings and recruiters with verified badges could make the operation difficult for applicants to identify as fraudulent.

Korolevski advised employers to establish stricter security procedures for recruitment exercises involving downloadable files.

He recommended that technical assignments requiring downloads should only be executed inside disposable virtual machines rather than employees’ work computers.

He also urged organisations to warn staff against opening unfamiliar files, even when they appear to come from trusted contacts.

Developers were further advised to examine when recruiters’ LinkedIn accounts were created and verify whether a company’s location and other details remain consistent across its different online platforms.

The latest disclosures highlight how North Korean-linked cybercriminals are combining cryptocurrency theft, compromised communication accounts, deepfake technology and fraudulent recruitment exercises to gain access to valuable digital assets and sensitive corporate systems.