What Happened
The FBI says North Korea-linked hackers stole more than $400 million in cryptocurrency through FaceStealer, a social engineering scheme built on hijacked accounts and deepfake video calls, The Hacker News reports. US authorities seized the cloud infrastructure behind the campaign and more than 900 webcam recordings of victims. The Justice Department also announced the seizure or restraint of more than $1.2 billion stolen from Binance by the TraderTraitor group.
FaceStealer runs through BlueNoroff, also tracked as APT38 and Sapphire Sleet. Attackers hijack Telegram, LinkedIn, Slack, and Discord accounts, then invite the victim’s contacts to video meetings on typosquatted Zoom and Teams domains. Prerecorded or deepfake video of a trusted person builds confidence. A fake audio-error fix then installs malware. Arctic Wolf counted 677 targets across 58 countries, with more than 80% founders or C-suite executives.
Why This Matters for Canadian Organizations
Canada hosts a dense cluster of crypto exchanges, fintech startups, and venture-backed software firms in Toronto, Vancouver, and Montreal. These are the exact profiles FaceStealer hunts. The attack bypasses email security entirely. It arrives through a known contact’s real account on a chat platform, with a familiar face on screen.
Senior leaders often hold treasury wallet keys, signing authority, and privileged cloud access. A single infected executive laptop exposes all of them. The related Contagious Interview campaign compromised at least 30,000 devices in 100 countries through fake job interviews, which puts Canadian developers in scope too. Stolen client funds or data at a Canadian firm bring PIPEDA breach duties, and registered money services businesses answer to FINTRAC.
What to Do
Brief executives and founders on this playbook this week. Verify any unexpected meeting invite through a second channel, even from a known contact. Never run audio or video fixes pasted from a meeting page. Block typosquatted conferencing domains at DNS and allow only managed Zoom and Teams clients. Run recruiter coding tests in disposable virtual machines, never on work laptops. Keep treasury keys in hardware wallets with multi-person approval. Report incidents to the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security. See our Trends coverage and latest news for related threats.
