The FBI and the Department of Justice have given a name, FaceStealer, to a North Korean social-engineering campaign and seized cloud infrastructure that held 900 videos of targeted victims.
According to the DoJ, North Korea runs the operation to fund its government. The FBI attributes about $400 million in stolen cryptocurrency to it, and the campaign has reportedly been running for at least 18 months. It also reportedly isn't likely to stop after this seizure. The FBI's account describes the method in detail. Attackers first break into a person's messaging apps and copy old conversations, contact lists and, crucially, video of the victim or their contacts. They then use that material to approach the real target with a job or investment offer.
The pitch ends in a Zoom or Teams meeting hosted on an attacker-controlled server, at a look-alike address such as "teams.livemeet.us". Deepfaked participants or replayed recordings fill the call. Then a "technical problem" appears, and the victim is told to install an update that carries malware. From there the attackers take browser sessions and the credentials developers use to build and publish code, which lead to crypto wallets or to a better-placed victim. The FBI says this can repeat in cycles. A Binance developer was one such stepping stone, according to the source.
The FBI also warns that the hackers have repeatedly tried to slip into open-source software, mainly JavaScript packages on NPM and Rust libraries known as crates. The source says one example, though the FBI does not name it, is almost certainly the March 2026 Axios compromise. Axios sees about 100 million downloads a week, and it briefly contained a remote-access tool. Its developer was lured by someone posing as a company interested in hiring him, complete with a cloned CEO persona, a Slack workspace and a Teams call with several "people."
The pattern matters more than the seizure. The attack targets a person's trust, not a software flaw, and a single maintainer can sit upstream of millions of installs. Because early victims supply the footage and context for later ones, the next invitation you get may look convincing precisely because someone you know was compromised first.