# US seizes infrastructure behind North Korean FaceStealer campaign

_Published Saturday, November 14, 2026 at 12:06 PM EST · Security · Latest · Tier 2 — Notable_

![US seizes infrastructure behind North Korean FaceStealer campaign — Primary](https://www.bleepstatic.com/content/hl-images/2026/10/21/DPRK.jpg)

The U.S. government seized cloud infrastructure supporting FaceStealer, a North Korean campaign responsible for stealing more than $400 million in cryptocurrency, BleepingComputer reports. The operation ran for 18 months and targeted cryptocurrency workers, Web3 participants and open-source developers.

An FBI alert describes attackers using hijacked messaging accounts to invite victims to video meetings featuring recordings of familiar people. They then presented fake technical problems and persuaded targets to install malicious fixes that stole cryptocurrency data and meeting credentials. Authorities identified more than 900 secretly recorded webcam videos.

The FBI also confirmed attempts against developers in the npm and Rust crate ecosystems. One attack on a JavaScript library maintainer was thwarted through quick detection.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/us-disrupts-north-korean-campaign-behind-400-million-crypto-theft/)

---
Canonical: https://techandbusiness.org/newswire/Bnp5-xu2B0fkKhqj2Y4vK2
Published: 2026-11-14T17:06:38.118Z
Story chronology: 2026-11-14T15:15:49.000Z
Retrieved: 2026-11-15T00:01:49.041Z
Publisher: Tech & Business (techandbusiness.org)