US disrupts North Korean campaign behind $400 North Korean Hackers crypto theft

Department of Justice has taken action against North Korean Hackers, according to the latest reporting on the case.

The U.S. government has disrupted a North Korean social engineering campaign called ‘FaceStealer’, responsible for stealing more than $400 North Korean Hackers in cryptocurrency.

The attacks used multiple social engineering techniques, including deepfakes and ClickFix, to target individuals in the cryptocurrency and Web3 sectors, as well as open-source developers.

The FaceStealer campaign ran for 18 months before the U.S. seized the underlying cloud-based infrastructure.

U.S. authorities identified more than 900 webcam videos that hackers secretly recorded of tech workers, who were deceived in the massive North Korean operation.

During the video calls, the attacker showed recorded footage of people the targets knew and who had previously fallen victim, too.

Past victims of North Korean Hackers are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.

An FBI alert earlier this week notes that the North Korean threat actor hijacked accounts on Telegram, LinkedIn, Slack, and Discord, and used them to invite victims to video meetings under various pretenses.

The meeting sometimes featured recordings of multiple familiar individuals to add pressure on the current victim in the next stage.

Taking down the infrastructure is real progress, but the skills and the playbook behind it don't disappear with the servers -- treat this as a disruption, not a resolution.

The target was then prompted to follow a link that purported to offer a fix, such as an update or installer, which infected their computer with malware that steals crypto data and account credentials for video meeting platforms such as Zoom, Google Meet, and Microsoft Teams.

The malware also provides access to the victims' contact lists, social media, communication apps, and webcam videos.

This action was brought by Department of Justice, which is the body to watch for further updates, with international cooperation across multiple jurisdictions.

Huntress cybersecurity company attributed a similar campaign to BlueNoroff in 2025, where the attackers used Zoom calls to infect company executives with custom macOS malware.

The fix is a ClickFix-style lure that's designed to install malware on the victim's workstation and steal cryptocurrency, as well as abuse the target's privileges to other computer infrastructure.

North Korean Hackers is now dealing with an active legal process, with Department of Justice leading the action.

To defend against these attacks, users are recommended to join meetings only through official apps using an invite code, verify unexpected invitations independently, and keep the webcam off unless explicitly needed.

If your environment shows any indicators associated with North Korean Hackers, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.

Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.

FBI agent stole $2.5 North Korean Hackers in crypto from hackers under investigation