The US Department of Justice has seized infrastructure associated with North Korea's FaceStealer scheme, which reportedly resulted in thefts exceeding $400 million over the past 18 months. The FBI seized over 900 secretly recorded webcam videos from victims of this scheme.
The FaceStealer operation primarily targeted individuals in the crypto and Web3 sectors. Attackers used fake video calls to install malware on victims' devices, employing tactics such as impersonating trusted contacts and using lookalike domains for popular video conferencing platforms.
The DOJ also froze more than $1.2 billion in cryptocurrency linked to North Korean cyber activities, including a recent theft from Binance attributed to North Korean groups, which totaled over $6 billion.
The FBI has linked the FaceStealer operation to several North Korean state-sponsored hacking groups, including APT38 and BlueNoroff. The scheme relied on deceiving victims during video calls rather than breaking cryptography.
The DOJ's actions against FaceStealer were announced between November 10 and 12, 2026. Despite the disruption, the FBI warned that the FaceStealer campaign could continue to target more users.
The operation has raised concerns about potential supply-chain attacks targeting open-source software developers. Attackers also used AI-generated deepfakes to enhance their deception during video calls.