[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpDOawW_5WfAUQNS1bLCBBc7SgNczWIiUEYNrZxpVW8s":3},{"article":4,"iocs":53,"watch_terms":63,"solutions":64,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a38c727e-346f-40f8-a0d4-9c1ccdfcca1d","FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls","fbi-says-north-korean-hackers-stole-over-400-million-in-crypto-using-deepfake-vi-d32b5f","The U.S. Federal Bureau of Investigation (FBI) has established that threat actors tied to the Democratic People's Republic of Korea (DPRK aka North Korea) have stolen more than $400 million worth of cryptocurrency as part of a social engineering scheme codenamed FaceStealer in the last 18 months. As part of a coordinated set of actions announced by the U.S. government, the cloud-based","The FBI has revealed that North Korean threat actors, operating under the codename FaceStealer, have stolen over $400 million in cryptocurrency in the past 18 months. This social engineering scheme utilizes recorded videos and deepfakes to trick targets into installing malware that steals crypto and compromises their systems. The U.S. government has seized the infrastructure used in this campaign and also announced the restraint of over $1.2 billion in crypto stolen by the TraderTraitor actors.","North Korean hackers stole over $400M in crypto using deepfake video calls.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Ffbi-says-north-korean-hackers-stole.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhDmjJA-t4vvigohRIfUR6JExYEPR0Dohh29eooVagQOvRyRDgdisxAy3wSWni5iFHjf2Dk8X2BavSeGO8hJ-wCTbDuffsdtamOuqj1PVTb75EWNF5vNe3tCsS6pyS_pSzNhEELOVU0DxHdmGx4Kt8KNqwz8YheAM9kEoVmpnHeVV1qsofLCBYDEt0E2IqX\u002Fs1600\u002Fflash.jpg","2026-11-13T14:28:58+00:00","2026-11-13T16:00:26.060894+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"TraderTraitor","threat_actor",{"name":21,"type":19},"BlueNoroff",{"name":23,"type":19},"APT38",{"name":25,"type":19},"CageyChameleon",{"name":27,"type":19},"CryptoCore",{"name":29,"type":19},"DangerousPassword","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60],{"type":47,"value":55,"context":56},"FaceStealer","Social engineering scheme and malware used by North Korean threat actors.",{"type":47,"value":58,"context":59},"GhostCall","Campaign documented by Kaspersky that shares aspects with FaceStealer.",{"type":47,"value":61,"context":62},"ClickFix","Lure used to install malware in the FaceStealer scheme.",[],{"controls":65,"vendors":148},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":96,"name":97,"problem":98,"products":99},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",[100,107,115],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":102,"url":105,"description":106},"thinkst-canary","Thinkst Canary","\u002Fvendor-logos\u002Fthinkst-canary.png","canary","https:\u002F\u002Fcanary.tools\u002F","Hardware, virtual and cloud honeypots that pose as servers, routers or file shares and alert the moment an attacker interacts with them.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-deception","Zscaler Deception","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fdeception-technology","Decoys built into the Zscaler platform that turn any attacker interaction into a confirmed alert.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"tracebit","Tracebit","\u002Fvendor-logos\u002Ftracebit.png","tracebit-canaries","Tracebit Security Canaries","https:\u002F\u002Ftracebit.com\u002Fplatform\u002Fcredentials-and-artifacts","Deploys and maintains decoy credentials, cloud resources and files across AWS, Azure, Google Cloud, Kubernetes, CI\u002FCD, identity providers and workstations.",{"slug":124,"name":125,"problem":126,"products":127},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[128,135,142],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":124,"product_name":132,"url":133,"description":134},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":136,"product_name":139,"url":140,"description":141},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":143,"product_name":144,"url":146,"description":147},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":159},"north-korean-deepfake-video-calls-drain-400m-in-crypto","North Korean Deepfake Video Calls Drain $400M in Crypto","North Korean threat actors used AI-generated deepfake video calls and recorded videos to impersonate trusted individuals, convincing targets to install malware that stole cryptocurrency credentials and compromised systems. The root failure is a lack of security awareness: targets were unable to distinguish synthetic media from authentic communications and were socially engineered into executing malicious software. This matters because deepfake-enabled social engineering bypasses traditional technical defenses entirely, exploiting human judgment rather than software vulnerabilities. Organizations and individuals holding high-value crypto assets are prime targets, and a single successful deception can result in catastrophic, often irreversible financial loss.",[154,155,156,157,158],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1204: User Execution","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(j)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(g)":160,"NIS2 Article 21(2)(j)":161,"MITRE ATT&CK T1566: Phishing":162,"MITRE ATT&CK T1204: User Execution":163,"CIS Control 14: Security Awareness and Skills Training (v8)":164},"This point requires basic cyber hygiene and training for staff, which would have equipped targets to recognize and resist deepfake-based social engineering before installing malware.","Mandatory multi-factor authentication and secured communications channels would have added a verification layer that deepfake video calls alone could not satisfy, limiting unauthorized access and transactions.","The attackers used deepfake video calls as a phishing vector to manipulate targets into installing malware, which is exactly the social-engineering initial-access technique this entry covers.","Victims were tricked into manually executing malicious software delivered through the deepfake interaction, the precise user-execution technique this entry describes.","This control explicitly requires organizations to train users to identify and resist social-engineering attacks, the primary defense that failed when targets were deceived by synthetic video personas."]