source_4160.pdf (728 KB)

The FBI attributes the FaceStealer campaign to North Korean state-sponsored hackers tracked under names including Sapphire Sleet, UNC1069, APT38, BlueNoroff, and Stardust Chollima. The actors reportedly stole more than $400 million in cryptocurrency over 18 months by hijacking trusted accounts, staging fake video meetings with prerecorded victim footage, and inducing targets to install malware. The FBI seized more than 900 victim webcam recordings used for follow-on impersonation and warned that deepfakes are now supplementing genuine recordings. The campaign also targeted NPM, Rust, and other open-source maintainers in attempts to introduce malicious dependencies into widely downloaded software.