According to a U.S. Department of Justice announcement on November 12, the FBI disrupted a North Korean cyberattack operation known as FaceStealer that stole over $400 million in cryptocurrency over 18 months. The operation used secretly recorded webcam footage, compromised communication accounts and AI-generated deepfakes to deceive cryptocurrency holders and industry employees into installing malware.
Federal authorities seized cloud infrastructure supporting the campaign and more than 900 videos of victims. The hackers infiltrated victims' communication accounts and used them to invite contacts to fraudulent video meetings impersonating trusted colleagues, then instructed victims to install malicious software by claiming technical issues with audio.