[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-fbi-seizes-facestealer-infrastructure-tied-to-400m-crypto-theft":10,"sections":49},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":38,"tags":39,"sources":44,"feedback":48,"feedback_at":22,"cost_usd":48,"total_tokens":48},13176,"fbi-seizes-facestealer-infrastructure-tied-to-400m-crypto-theft","FBI Seizes FaceStealer Infrastructure Tied to $400M Crypto Theft","The FBI and DoJ named a campaign they tie to North Korea, built on deepfaked video calls, and seized cloud infrastructure holding 900 videos of targets.","The FBI and the Department of Justice have given a name, FaceStealer, to a North Korean social-engineering campaign and seized cloud infrastructure that held 900 videos of targeted victims.\n\nAccording to the DoJ, North Korea runs the operation to fund its government. The FBI attributes about $400 million in stolen cryptocurrency to it, and the campaign has reportedly been running for at least 18 months. It also reportedly isn't likely to stop after this seizure. The FBI's account describes the method in detail. Attackers first break into a person's messaging apps and copy old conversations, contact lists and, crucially, video of the victim or their contacts. They then use that material to approach the real target with a job or investment offer.\n\nThe pitch ends in a Zoom or Teams meeting hosted on an attacker-controlled server, at a look-alike address such as \"teams.livemeet.us\". Deepfaked participants or replayed recordings fill the call. Then a \"technical problem\" appears, and the victim is told to install an update that carries malware. From there the attackers take browser sessions and the credentials developers use to build and publish code, which lead to crypto wallets or to a better-placed victim. The FBI says this can repeat in cycles. A Binance developer was one such stepping stone, according to the source.\n\nThe FBI also warns that the hackers have repeatedly tried to slip into open-source software, mainly JavaScript packages on NPM and Rust libraries known as crates. The source says one example, though the FBI does not name it, is almost certainly the March 2026 Axios compromise. Axios sees about 100 million downloads a week, and it briefly contained a remote-access tool. Its developer was lured by someone posing as a company interested in hiring him, complete with a cloned CEO persona, a Slack workspace and a Teams call with several \"people.\"\n\nThe pattern matters more than the seizure. The attack targets a person's trust, not a software flaw, and a single maintainer can sit upstream of millions of installs. Because early victims supply the footage and context for later ones, the next invitation you get may look convincing precisely because someone you know was compromised first.","[\"north-korea\",\"phishing\",\"deepfakes\",\"open-source\"]","2026-11-15T16:30:00.000Z","2026-11-15T18:51:40.554Z","2026-11-15T18:52:32.162Z","published",null,[24,30,34],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"The body says the campaign accounts for about $400 million in thefts, yet calls the Binance hack its largest case at more than $5 billion, and never reconciles the two figures. Either explain it, for example by separating the amount stolen from the amount actually lost after freezes and recoveries, or flag the Binance figure as unverified. The dek's '$400 million' claim should also be checked against the primary FBI report, and 'seizes servers' in the headline should be reworded to match the sou","resolved",{"id":31,"reviewer":26,"round":32,"reason":33,"status":29},"editor-r2",2,"The $400 million vs. $5 billion Binance gap is still unreconciled, and the draft now leans on it: the dek says the figures 'do not line up' and the body contains reporting-gap text ('The source does not explain how those numbers fit together', 'read both as unreconciled until the FBI's own report is checked'). Check both figures against the FBI report, or drop the Binance total and attribution as unverified. Then either separate the amount stolen from the net loss after freezes and recoveries, o",{"id":35,"reviewer":26,"round":36,"reason":37,"status":29},"editor-r3",3,"Dropping the Binance $5 billion claim fixes the $400 million vs. $5 billion conflict, but verify the spelling of the Axios maintainer's name (the source's 'Sayayman' looks like a misspelling of 'Saayman', so correct it or drop the name), and soften 'The agency expects it to continue' to match the source's hedged 'reportedly isn't likely to stop'.","security",[40,41,42,43],"north-korea","phishing","deepfakes","open-source",[45],{"name":46,"url":47},"Tom's Hardware","https:\u002F\u002Fwww.tomshardware.com\u002Ftech-industry\u002Fcyber-security\u002Ffbi-disrupts-north-korean-facestealer-campaign-behind-usd5-billion-binance-hack-doj-seizes-facestealer-cloud-infrastructure-containing-900-videos-of-tech-workers-hackers-used-ai-deepfakes-to-steal-usd400-million-and-compromise-open-source-software",0,{"sections":50},[51,56,60,65,70,75,80,85,90,95,100,105,110,115],{"name":52,"slug":53,"count":54,"latest_published_at":55},"AI","ai",7162,"2026-11-15T12:00:00.000Z",{"name":57,"slug":38,"count":58,"latest_published_at":59},"Security",1141,"2026-11-15T17:15:13.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Deals","deals",672,"2026-11-15T17:59:53.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Policy","policy",630,"2026-11-15T16:25:16.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Consumer Tech","consumer-tech",383,"2026-11-15T17:55:32.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Hardware","hardware",344,"2026-11-15T17:00:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Science","science",236,"2026-11-14T20:54:14.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Software","software",177,"2026-11-14T08:54:55.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Startups","startups",162,"2026-11-13T17:32:35.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"General","general",130,"2026-11-15T15:41:13.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Dev Tools","dev-tools",127,"2026-11-11T19:00:44.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"Gaming","gaming",112,"2026-11-14T19:34:13.000Z",{"name":111,"slug":112,"count":113,"latest_published_at":114},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":116,"slug":117,"count":118,"latest_published_at":119},"How-To","how-to",10,"2026-11-14T23:45:00.000Z"]