FBI targets FaceStealer deepfake campaign linked to $5 billion Binance heist

United States law enforcement has disrupted a major social engineering operation dubbed FaceStealer. The Federal Bureau of Investigation and the Department of Justice announced the seizure of cloud servers linked to the campaign. Officials say North Korea runs the group to steal cryptocurrency to fund its government.

Fake calls and AI video tricks

FaceStealer has operated for at least 18 months. It uses sophisticated spear-phishingSpear-phishingA targeted online scam that uses personal details to trick a specific person into giving up data or access. Open in glossary tactics that involve months of planning. During the server seizure, FBI technicians found 900 videos of targeted victims.

Attackers begin by breaking into communication tools used by targets. They steal chat logs, contact books, and covert video recordings. They then build realistic personas to lure victims into fake job interviews or investment pitches. These meetings take place on services designed to mimic Zoom or Microsoft Teams, hosted on typo-squatted domains.

During these calls, the hackers use AI deepfakes and recorded video clips of real contacts to make the meeting look authentic. The scammers then invent a technical problem and ask the target to install a fake update or tool. This software drops malware that gives the attackers control of the victim’s machine.

Crypto heists and developer targets

Once inside a system, the hackers steal browser sessions, passwords, and access tokens. The FBI attributes about $400 million in stolen crypto to the campaign. The group was also linked to a massive hack on crypto exchange Binance, which saw over $5 billion taken, though most of those funds were later frozen or recovered.

The group also targets open-source developers to inject malware into widely used tools, specifically JavaScript NPM modules and Rust crates. In one instance, attackers targeted Axios developer Jason Sayayman with a fake hiring process, using spoofed Slack workspaces and video meetings to compromise systems.