FBI disrupts North Korean FaceStealer campaign behind $5 billion Binance hack
The ongoing social-engineering campaign that's reportedly taken $400 million in cryptocurrency from victims and was behind the recent Binance heist now has a name: FaceStealer. The moniker came from the FBI and the U.S. Department of Justice (DoJ), who have announced a fight against this crime wave, starting with the seizure of associated cloud infrastructure. According to the DoJ, North Korea is behind these attacks, stealing cryptocurrency to fund its government.
The DoJ's press release on the matter is blustery, but the FBI's detailed report contains the important details. The agency's techs seized "cloud-based infrastructure," containing 900 videos of targeted victims. FaceStealer is an advanced form of spear-phishing, complete with AI deepfakes, usage of the victims' contact networks and personal information, and carefully orchestrated preparation - sometimes months in advance.
The campaign isn't likely to stop despite the setback, and has reportedly been running for at least 18 months, a timeline that matches up with documented instances of similar intrusion attempts. The largest heist attributed to FaceStealer is the recent Binance hack that saw thieves make out the proverbial door with over $5 billion (most of it thankfully frozen and/or recovered), but far from the only one.
The FBI attributes about $400m in stolen cryptocurrency to the campaign, and importantly, also notes that the hackers have repeatedly tried to sneak into open-source software, chiefly Javascript/NPM modules and Rust crates. Despite not being mentioned by name, one example hack is almost certainly the Axios compromise from March 2026. The Node/Javascript library sees about 100 million downloads a week, and temporarily contained a remote-access tool - thankfully for only a few hours.
Jason Sayayman, the Axios developer in question, got hooked by an attacker posing as a legitimate company interested in hiring him. The malfeasants replicated the CEO's persona, created a Slack workspace with legitimate-looking channels, then invited him to a Teams meeting with multiple "people."
This modus operandi is what the FBI warns about. According to the bureau, FaceStealers start by getting access to a person's communication application(s), then lifting all previous conversations, contact lists, and, most importantly, stealthily recording video of them and/or their contacts. The footage and information will then be used to catch the actual targeted victim, who'll often be sent offers for jobs or investment opportunities.
The victim will eventually be invited to a Zoom or Teams meeting that's actually hosted on an attacker-controlled server, with a typo-squatted domain like "uu01webzoom.us" or "teams.livemeet.us". The meeting will often have deepfaked AI participants and/or previous meeting recordings playing, granting the event an air of legitimacy - particularly because conversations leading up to this point will contain real information and context.
At some point, though, there will be some sort of "technical problem," and the victim will be prompted to install an "update" or software to fix the problem, which is loaded with malware. From there, the attackers have free rein over the victim's computer and data, and will siphon off browser sessions, CI/CD passwords, and all manners of access credentials to eventually get access to cryptocurrency wallets - or just use this information to find a juicier target, like the poor Binance developer through which Binance's hot wallets were broken into.
The FBI says that the above scenario may play out in multiple cycles until the attackers reach their intended target, collecting loads of precious video and information along the way to make the final strike much more convincing.