FBI warns of North Korean ‘FaceStealer’ campaign targeting American employees

ktla ^ | Nov 13, 2026 | Will Conybeare

[BenLurkin]

Federal authorities are warning Americans – especially those in the tech and cryptocurrency industries – of the “FaceStealer” scam and social engineering campaign.

According to the FBI, “cyberactors” from North Korea are aggressively targeting companies and individuals in the cryptocurrency and Web3 industries with “highly tailored, hard-to-detect social engineering campaigns” that have led to billions of dollars in cryptocurrency being stolen in recent years. It should be noted that the main North Korean hacking group is referred to by a number of names, including Sapphire Sleet, UNC1069, Stardust Chollima, APT38 and BlueNoroff.

One of the main ways the scammers go about this is “FaceStealer,” described by the FBI as a scheme that uses imposter versions of video conferencing platforms, secret webcam video recordings and computer intrusions.

The most-targeted individuals, such as open-source and supply chain software developers, are lured to those fake platforms, where the scammers then gain access to their devices and accounts. More specifically, multiple hacking attempts have been directed at maintainers with repositories on the JavaScript registry, Node Packet Manager (NPM) and, more recently, against maintainers of Rust crates.

“Their objective is compromise of the software supply chain,” the FBI says. “By infiltrating accounts of trusted developers and maintainers, the threat actors can potentially distribute malicious code through widely used software, impacting millions of downstream users.”

“In targeting software developers and maintainers, the hackers are trying to gain access to their devices and the software repository accounts they control,” the bureau added. “If the hackers can infect the distribution of the software, they can compromise the supply chain and turn a single victim — the developer or maintainer — into potentially millions of victims.”

That was “nearly achieved” earlier this year, federal investigators said.

---

TOPICS: Computers/Internet
KEYWORDS: apt38; bluenoroff; facestealer; northkorea; sapphiresleet; stardustchollima; unc1069

[BenLurkin]

[x]

John Travolta and Nicolas Cage most affected ...

[ComputerGuy]

Sometimes not having anything worth stealing is worth something.

[Nervous Tick]

🤣
Me: “I want a second opinion”
Dr.: “Ok. You’re ugly too!”

[Red Badger]

And crypto currency is safe............

[catbertz]

I’ve been a tech enthusiast since jr high in 1980, loving every new development and breakthrough, but I’m quickly turning into a crusty old luddite. Some version of the worst dystopian tech future is now approaching at mach 6.