Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

FBI seizes FaceStealer infrastructure tied to $400 million crypto theft

4 sources · 4 articlesFirst reported Updated ()1
What's new

November 13: Hacker News adds Google Meet lures, more than 900 people targeted, and an FBI claim that FaceStealer proceeds fund North Korea’s weapons program.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

The FBI has seized FaceStealer cloud infrastructure and more than 900 webcam clips tied to over $400 million in crypto theft.

The U.S. Justice Department and FBI said on November 12, 2026, that they seized cloud infrastructure behind FaceStealer, a North Korean social-engineering scheme the FBI links to more than $400 million in cryptocurrency theft over 18 months. Hijacked Telegram, LinkedIn, Slack and Discord accounts send Calendly invites and lookalike Zoom, Teams or Google Meet links to crypto and Web3 workers and open-source maintainers. Stolen or deepfake webcam video is played on the calls; victims paste a fake audio or ClickFix-style fix that installs a cookie harvester, keyloggers, a screen capturer and a backdoor. More than 900 recordings were seized and targets were warned. A malicious-dependency attempt against a widely downloaded JavaScript library was stopped. Help Net Security names Sapphire Sleet, BlueNoroff and APT38; The Hacker News says BlueNoroff is also tracked as APT38 and UNC1069.

Key facts
  • FBI links FaceStealer to more than $400 million stolen over 18 months.
  • More than 900 webcam recordings were seized; targets were warned November 12.
  • Lures use hijacked accounts, Calendly and lookalike Zoom, Teams or Google Meet links.
  • Malware includes a cookie harvester, keyloggers, a screen capturer and a backdoor.
  • A malicious-dependency attempt against a major JavaScript library was stopped.
  • Some wallet drains waited months to more than a year, according to the reports.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Nov 12, 2026DOJ and FBI announce FaceStealer infrastructure seizure · GBHackers

What each outlet adds

beyond the shared facts
  • Help Net SecurityNames Sapphire Sleet with BlueNoroff and APT38; cites uu01webzoom.us.
  • The Hacker NewsAdds UNC1069, teams.livemeet.us, JUMPSEC’s chain and GhostCall overlap.
  • Hacker NewsAdds Google Meet and an FBI weapons-funding claim for the proceeds.
  • GBHackersDetails the November 12 cloud seizure and delayed wallet drains.
Products
ZoomMicrosoft TeamsTelegramGoogle Meet
Threat actors
BlueNoroffAPT38TraderTraitorUNC1069Sapphire Sleet
Malware
FaceStealer
Victims
Binance
Organizations
FBIU.S. Department of JusticeKasperskyJUMPSECU.S. Justice DepartmentUS Justice Department
Countries
North KoreaUnited States
AI models
ChatGPT

Coverage

oldest first · one row per article · UTC
  1. · 1d ago Help Net SecurityFirst report

    FBI: North Korean fake Zoom scheme stole over $400 million

    FaceStealer uses seized webcam clips of more than 900 victims so each infected call supplies the next familiar face.

  2. · 1d ago GBHackers

    FBI seizes infrastructure used in North Korean FaceStealer scheme

    The scheme is tied to more than $400 million in crypto theft, while agencies have frozen over $2.7 billion from a separate Binance theft.

  3. · 23h ago The Hacker News

    FBI: North Korea's FaceStealer stole over $400 million in crypto

    U.S. authorities seized the campaign's cloud infrastructure and restrained more than $1.2 billion tied to a Binance theft by TraderTraitor.

  4. · 20h ago Hacker News · security

    FBI: North Korean FaceStealer calls stole over $400M in crypto

    More than 900 crypto and web3 workers were hit in 18 months after malware arrived through a fake audio-fix link.