North Korean hackers have turned hundreds of real people’s faces into reusable tools for cyberattacks, secretly recording victims during counterfeit video meetings and replaying their recordings to impersonate trusted colleagues, compromise new targets, and steal cryptocurrency.
The Federal Bureau of Investigation (FBI) says the operation, called “FaceStealer,” has stolen more than $400 million in cryptocurrency over 18 months and amassed more than 900 webcam recordings of victims, exposing an identity attack built around authentic faces, hijacked accounts, synthetic video, and stolen professional relationships.
The Department of Justice announced Thursday that authorities had seized cloud infrastructure supporting the operation. An accompanying FBI technical advisory details how North Korean state-sponsored hackers systematically weaponized victims’ identities.
The findings expose an impersonation technique that does not require generating artificial faces. Instead, attackers use recordings of real people to persuade colleagues and professional contacts that they are participating in legitimate conversations.
Each compromise supplies another recognizable face, a collection of contacts, and potentially another trusted account from which to approach future victims.
The FBI says the operation has expanded into attacks against maintainers of widely distributed open-source software, potentially exposing organizations far removed from the original targets.
How stolen identities become new attacks
FaceStealer typically begins with a compromised individual whose communications accounts, contact lists, conversation histories, and webcam recordings have been stolen.
Using that person’s legitimate Telegram account or another hijacked platform, the hackers invite contacts to what appears to be a routine Zoom or Microsoft Teams meeting.
Because the attackers possess previous messages, invitations can reference established business relationships. Legitimate scheduling services such as Calendly add credibility.
Shortly before the meeting, the target receives a link that looks like a legitimate conferencing address but leads to an attacker-controlled replica.
Once the target joins, hackers play prerecorded footage of the person whose account was compromised. Several recorded participants may appear simultaneously, creating the impression of an ordinary group meeting.
The attackers then manufacture a technical problem, often claiming the target’s microphone is malfunctioning. A supposed participant offers instructions to repair it by installing an update, executing a script, or entering commands into a computer terminal.
Those instructions install malware that can harvest browser cookies, record keystrokes, capture screens, and establish persistent access.
Meanwhile, the counterfeit meeting has already begun recording the new victim’s webcam.
The FBI describes a continuing cycle in which compromised individuals become the raw material for subsequent impersonations. In some cases, hackers waited months or more than a year before exploiting credentials or stealing cryptocurrency.
The attack exploits a familiar assumption: seeing someone’s face during a video conversation suggests the person is actually participating.
Deepfakes expand the impersonation operation
The FBI says FaceStealer increasingly uses AI-generated videos of prominent cryptocurrency executives, letting attackers impersonate individuals whose devices they have never compromised.
Genuine stolen recordings, however, remain the predominant method.
“The quality of the deepfakes only needs to be good enough to pass as webcam video,” the FBI advisory states.
Independent research published Thursday by Arctic Wolf Labs shows how extensively the operation has evolved.
Researchers who obtained visibility into infrastructure associated with the North Korean group BlueNoroff identified material targeting 677 individuals across 58 countries. Founders and senior executives accounted for 84 percent of identified targets, although those figures do not represent confirmed compromises.
Researchers also identified 98 high-confidence malicious domains, including 73 not previously reported.
The investigation found attackers collecting faces and voices from YouTube interviews, conference presentations, and other public recordings, enabling them to create apparently authentic meeting footage without first compromising the person being impersonated.
Arctic Wolf documented the use of generative AI tools in producing fabricated audiovisual material. Researchers said some synthetic videos could no longer reliably be distinguished from genuine webcam recordings through visual inspection alone.
The attackers have also expanded beyond counterfeit meetings into fraudulent document-sharing requests, software update prompts, media players, hardware-wallet workflows, and identity verification requests.
These findings extend concerns examined in previous Biometric Update reporting on deepfake tools and remote identity verification.
FaceStealer presents a related but distinct threat. Rather than showing that automated biometric recognition or liveness detection has been defeated, it shows how recognizable human identities can be exploited to undermine the informal verification that occurs during ordinary professional interactions.
From stolen faces to compromised software
The FBI disclosed that North Korean hackers used the same impersonation technique to compromise a maintainer of a major JavaScript software library that is downloaded tens of millions of times weekly.
The maintainer entered a counterfeit Microsoft Teams meeting containing several apparent participants, including someone the developer recognized. After following instructions to correct a fabricated technical problem, the maintainer unwittingly installed malware.
Attackers subsequently exploited the maintainer’s repository access to introduce malicious dependencies that could have spread through legitimate downloads.
The FBI says rapid detection prevented potentially widespread victimization. It did not identify the library but said similar attacks targeted maintainers of Node Package Manager (npm) repositories and Rust software packages.
A closely matching attack occurred March 31 against Axios, a widely used JavaScript library.
In an April postmortem, Axios maintainer Jason Saayman described an elaborate impersonation involving a purported company founder, a fabricated Slack workspace, and a Teams meeting that compromised his computer.
Attackers obtained his publishing credentials and released two malicious Axios versions containing a dependency called plain-crypto-js. The contaminated packages were removed approximately three hours later. Plain-crypto-js is a malicious npm package associated with a software supply chain attack.
The Google Threat Intelligence Group attributed the incident to UNC1069, a North Korean threat actor also identified in the FBI advisory. However, available evidence does not establish whether Axios is the specific unnamed library the FBI described.
The broader supply-chain threat is independently documented.
In June, Microsoft Threat Intelligence reported that Sapphire Sleet, another designation associated with North Korean cyber operations, compromised a maintainer account and published malicious versions of more than 140 packages in the Mastra software ecosystem.
Such compromises allow attackers to distribute malicious software under legitimate project identities, potentially exposing developers and organizations with no direct relationship to the original victim.
What the FBI seizure leaves unanswered
The Justice Department says authorities recovered more than 900 webcam recordings under a federal warrant and seized cloud infrastructure supporting FaceStealer.
Officials have not publicly identified the seized infrastructure, the number of servers involved, or whether investigators recovered the complete collection of stolen and synthetic identity material. Nor has the Department of Justice established whether the disruption permanently disabled the operation.
According to The Record’s coverage of an FBI briefing, investigators contacted and interviewed numerous victims but have not identified the operation’s first victim.
The government separately announced action involving cryptocurrency stolen from Binance in an October 29 attack attributed to another North Korean operation, TraderTraitor. Investigators have not established that FaceStealer was involved in that breach.
As Biometric Update previously reported, North Korean operators have also used synthetic identities, manipulated photographs, and fraudulent documents to obtain employment and access to software repositories.
FaceStealer reverses that approach. Rather than constructing an unfamiliar fictional person, attackers appropriate someone already trusted and exploit that individual’s appearance, communications history, and professional relationships.
In this operation, the stolen face is not simply evidence of an earlier compromise. It becomes the means of carrying out the next one.
Article Topics
deepfakes | FaceStealer | financial crime | identity theft | malware | North Korea | synthetic identity fraud | video conferencing
Latest Biometrics News
Nov 14, 2026, 1:17 pm EST
European analyses suggest biometric technologies can be used effectively without compromising privacy, while one of the EU’s major projects takes…
Nov 14, 2026, 12:23 pm EST
The Organisation for Economic Co-operation and Development (OECD), the Paris-based policy body of 38 advanced economies, has published a new…
Nov 13, 2026, 3:22 pm EST
Google is entering the AI glasses market with privacy protections designed to address controversies surrounding Meta’s smart eyewear. But its…
Nov 13, 2026, 3:15 pm EST
The best way to stop a face-swap attack may be to build a better one first. Sumsub and Constructor University‘s…
Nov 13, 2026, 3:14 pm EST
Online safety regulations are reshaping the internet as governments introduce new measures to reduce online harms. Two of the biggest…
Nov 13, 2026, 3:13 pm EST
Shufti has launched its on-device age verification tool. A release from the UK provider says the product combines on-device facial…
(function() {
var _fbq = window._fbq || (window._fbq = []);
if (!_fbq.loaded) {
var fbds = document.createElement(‘script’);
fbds.async = true;
fbds.src = “https://connect.facebook.net/en_US/fbds.js”;
var s = document.getElementsByTagName(‘script’)[0];
s.parentNode.insertBefore(fbds, s);
_fbq.loaded = true;
}
})();
window._fbq = window._fbq || [];
window._fbq.push([‘track’, ‘6024262178418’, {‘value’:’0.01′,’currency’:’CAD’}]);
Click Here For The Original Source.
——————————————————–
