US authorities have seized cloud infrastructure used by FaceStealer, a fake-meeting scheme the FBI says North Korea-linked hackers used to steal more than $400 million in cryptocurrency over 18 months.
US authorities seized the cloud-based infrastructure used in FaceStealer as part of coordinated government actions. The FBI says North Korea-linked hackers stole more than $400 million in cryptocurrency over 18 months through the scheme, which used trusted contacts and fake video meetings to target people in the cryptocurrency and Web3 sectors. The agency also seized more than 900 webcam recordings that attackers used to impersonate people in later attacks.
The seizure follows earlier research into the operation. Kaspersky documented overlapping activity under the name GhostCall in October 2025, Arctic Wolf studied the campaign in April 2026, and JUMPSEC analyzed its fake-meeting operation in July 2026.
Attackers send meeting invitations from accounts stolen from previous victims. During a fake call, they play recordings of people the target knows or use deepfakes—fabricated video of people—to build trust, while recording the new target’s webcam.
The attackers then invent an audio or other technical problem and offer a supposed fix. A link or instructions to run code can install malware, or malicious software, that captures sensitive data. Compromised wallets, recovery phrases, communication accounts and contact lists can give the attackers access to funds and a way to approach the next target.
The Hacker News links the activity to BlueNoroff, a North Korea-linked group also tracked as Sapphire Sleet and UNC1069. Its targets include open-source software developers and maintainers: access to their devices and software repository accounts can let attackers reach software used by others.
In the coordinated announcement, the US Justice Department also described a separate court-authorized seizure and restraint of more than $1.2 billion in cryptocurrency it said North Korea-linked TraderTraitor actors stole following a hack of the Binance exchange. That action concerns different assets and is separate from the FaceStealer infrastructure seizure.
Some owners say they cannot open YouTube on the new device. Tom Warren recommends updating the software, restarting the device and reinstalling the app as a workaround.
1 min
Germany’s security office says Danfoss has not provided enough updates to counter attacks on some cooling systems. CNA said attacks hit supermarket refrigerators and freezers from Sweden to Belgium, forcing stores to discard food. Operators should disconnect affected controls from the internet or secure their connections.
2 min
The agreement targets 7 gigawatts of solar and wind capacity in Turkey, as well as storage and grid improvements, but leaves financing and a timetable unannounced.
2 min
