ع
The US Justice Department detailed how the FaceStealer operation relies on hijacked accounts to lure targets into meetings on counterfeit versions of popular video platforms including Zoom, Microsoft Teams and Google Meet. Once connected, hackers play pre-recorded footage of trusted colleagues or use AI-generated deepfakes to build credibility before prompting victims to download software that purportedly fixes audio issues but actually installs malware. The FBI attributed the activity to North Korean state-sponsored groups known as Sapphire Sleet, UNC1069 and APT38 among others, according to its advisory.
According to the FBI, the malware allows access to contact lists and applications, enabling the cycle to expand as new victims’ identities are recorded and used against their networks. The bureau seized more than 900 webcam videos of victims as part of the disruption, which also targeted infrastructure supporting the scheme. In an announcement, the Justice Department stated that the actors have increasingly focused on open-source software developers to facilitate supply-chain attacks.
FBI Cyber Director Brett Leatherman said, “The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years.” The latest actions also include authorization to seize more than 1.2 billion dollars tied to a separate 6.3 billion dollar hack of cryptocurrency exchange Binance attributed to another North Korean group. Chainalysis data places North Korean-linked thefts at 1.34 billion dollars for 2024 alone, representing 61 percent of all cryptocurrency stolen that year.
The scheme begins with compromising a victim’s webcam to record footage, followed by hijacking their communication accounts to contact associates. Targets receive invitations that lead to fake meeting sites indistinguishable from legitimate ones, where the recorded video simulates participation. A message then appears requesting users to click a link to resolve a supposed technical glitch, which delivers the malicious payload.
Investigators noted that the operation has evolved to incorporate artificial intelligence for creating deepfake videos of prominent figures in the cryptocurrency industry to enhance deception. The FBI warned that even technically savvy users could fall victim to these tailored campaigns. Separate reporting from Reuters indicated that this cluster of hackers is distinct from the one responsible for the Binance breach.
The United Nations has estimated that North Korea stole 3 billion dollars in cryptocurrency between 2017 and 2023. A joint statement by the United States, Japan and South Korea in January 2025 attributed multiple major heists totaling 659 million dollars in 2024 to the Lazarus Group. The FBI has linked the FaceStealer campaign to the theft of more than 400 million dollars over 18 months from individuals in the cryptocurrency and Web3 sectors worldwide.
