Skip to navigation

Threat reportAPTTL-2026-5896

FaceStealer: DPRK (APT38-attributed) deepfake meeting social-engineering campaign disrupted by FBI/DOJ; $1.2B of stolen Binance crypto seized (TraderTraitor)

highACTIVE

FBI and DOJ disrupted cloud infrastructure behind 'FaceStealer', a North Korean (APT38-attributed) social-engineering campaign that stole over $400 million in crypto across 18 months using fake Calendly/Zoom/Teams meetings with pre-recorded and deepfake video to deliver malware. Separately, DOJ obtained authorization to seize or restrain more than $1.2 billion of the roughly $6.3 billion stolen from Binance, attributed by the FBI to TraderTraitor; the FBI says it is unclear whether FaceStealer was used in the Binance breach.

Key facts

IdentifiersTL-2026-5896
Also known asFaceStealer, Binance theft (2026-10)
SeverityHIGH
First disclosed
Affected productsMultiple Crypto-industry employee endpoints and accounts (Windows, macOS, Linux); npm / crates.io Open-source package maintainers (npm, Rust crates); Binance Exchange hot/cold wallet infrastructure
AttributionAPT38, TraderTraitor (high confidence)
Nation-state nexusNorth Korea
MalwareFLATROOF, FaceStealer, ROOFDECK, telegram
ToolsCalendly
MITRE ATT&CK techniquesT1055 Process Injection, T1059.001 PowerShell, T1071.001 Web Protocols, T1113 Screen Capture, T1125 Video Capture, T1195.002 Compromise Software Supply Chain, T1204.004 Malicious Copy and Paste, T1534 Internal Spearphishing, T1539 Steal Web Session Cookie, T1547.001 Registry Run Keys / Startup Folder, T1548.002 Bypass User Account Control, T1555.003 Credentials from Web Browsers and 5 more in the attack flow
MotivationFINANCIAL
Target sectorsfinance, cryptocurrency, technology, open-source software
Target regionsGlobal, North America
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5896 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: FaceStealer / BlueNoroff ClickFix PowerShell Download Cradle (Fake Zoom SDK Fix) — Exploitation

Detects the ClickFix execution step used by the DPRK APT38/BlueNoroff fake-meeting campaign (FaceStealer, TL-2026-5896): a user is told to paste a 'fix' or 'SDK update' command that runs PowerShell with an iwr/irm download piped to iex. Fires on the download-and-execute cradle when it carries the reported ZoomSDK user agent, /developer/sdk/update|fix/ URL pattern or a webzoom look-alike domain (e.g. uu03webzoom.us), or when it was started by a browser or explorer.exe (Run-dialog paste). Maps to T1204.004, T1059.001 and T1566.003. The lure indicators come from Arctic Wolf reporting on a related BlueNoroff campaign; the behavioural logic does not depend on them.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.004, T1059.001, T1566.003
  • Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=1, DeviceProcessEvents, sigma: windows process_creation
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*powershell.exe" OR Image="*pwsh.exe") (CommandLine="*iwr *" OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*irm *" OR CommandLine="*DownloadString*") (CommandLine="*| iex*" OR CommandLine="*|iex*" OR CommandLine="*Invoke-Expression*")
| eval lure_ioc=if(match(CommandLine,"(?i)ZoomSDK|/developer/sdk/(update|fix)/|[a-z]{2}[0-9]{2}webzoom"),1,0)
| eval browser_or_shell_parent=if(match(ParentImage,"(?i)(chrome|msedge|firefox|brave|explorer)[.]exe$"),1,0)
| where lure_ioc=1 OR browser_or_shell_parent=1
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images max(lure_ioc) as lure_ioc by host User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ('powershell.exe','pwsh.exe')
| where ProcessCommandLine has_any ('iwr ','Invoke-WebRequest','irm ','DownloadString')
| where ProcessCommandLine has_any ('| iex','|iex','Invoke-Expression')
| extend LureIoc = ProcessCommandLine has_any ('ZoomSDK','/developer/sdk/update/','/developer/sdk/fix/','webzoom'), BrowserOrShellParent = InitiatingProcessFileName in~ ('chrome.exe','msedge.exe','firefox.exe','brave.exe','explorer.exe')
| where LureIoc or BrowserOrShellParent
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, LureIoc

Sigma

title: ClickFix PowerShell Download Cradle Impersonating Zoom SDK Update
id: 5f3a9c1e-7b24-4d8e-9a61-2c4e8b7d1f30
status: experimental
description: Detects PowerShell iwr/irm download cradles piped to iex that carry the ZoomSDK user agent, /developer/sdk/update|fix/ URL pattern or webzoom look-alike domains, or that were launched by a browser or explorer.exe. Associated with BlueNoroff/APT38 fake Zoom/Teams meeting ClickFix lures (TL-2026-5896 FaceStealer).
references:
  - https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted
  - https://arcticwolf.com/resources/blog/bluenoroff-uses-clickfix-fileless-powershell-and-ai-generated-zoom-meetings-to-target-web3-sector/
author: Threadlinqs Team
date: 2026-11-12
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.initial-access
  - attack.t1566.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_download:
    CommandLine|contains:
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'irm '
      - 'DownloadString'
  selection_exec:
    CommandLine|contains:
      - '| iex'
      - '|iex'
      - 'Invoke-Expression'
  selection_lure:
    CommandLine|contains:
      - 'ZoomSDK'
      - '/developer/sdk/update/'
      - '/developer/sdk/fix/'
      - 'webzoom'
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\explorer.exe'
  condition: selection_img and selection_download and selection_exec and (selection_lure or selection_parent)
falsepositives:
  - Administrators or developers who run install one-liners (iwr | iex) from a Run dialog or terminal
  - Legitimate software bootstrap scripts that use a download cradle
level: high

Known false positives:

  • Administrators or developers running legitimate install one-liners (for example package-manager bootstrap scripts) via iwr | iex
  • Internal software deployment scripts that launch from explorer.exe and use a PowerShell download cradle

Tuning notes: Allowlist known internal bootstrap hosts and signed deployment script paths by excluding on destination host in CommandLine. Raise priority when lure_ioc=1 (ZoomSDK / sdk/update path / webzoom domain) or when the host user is a crypto or open-source maintainer. Requires Sysmon EventCode 1 with full command-line capture or Defender for Endpoint.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Connections to Fake Zoom/Teams/Meet Meeting Lure Domains — Exploitation · unlock with TL Creds
  • BlueNoroff Startup LNK Persistence, Stage Files and COM-Elevation UAC Bypass — Post-Exploitation · unlock with TL Creds
  • Proxy/Firewall Traffic to FaceStealer-Related C2 and Exfiltration Paths — C2 · unlock with TL Creds
  • Fake Microsoft Teams Meeting Installer (Teams_Installer.exe) Run From User-Writable Path — Exploitation · unlock with TL Creds
  • Remote Thread Injection Into Browser Process From Script Host or User-Writable Binary — Post-Exploitation · unlock with TL Creds
  • DNS Resolution of Related BlueNoroff and Community C2/Exfiltration Domains — C2 · unlock with TL Creds
  • Non-Browser Access to Chromium Cookie/Credential Stores or Telegram tdata — Post-Exploitation · unlock with TL Creds
  • PowerShell Implant Beaconing to Related BlueNoroff/Community C2 Infrastructure — C2 · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-5896.

Sample indicators (3 of 24)

  • IP address: 83.136.208[.]246
  • Domain: uu03webzoom[.]us
  • File hash: dd1c72823f933952619cbb86aaeaea43057a259e9a0c9e3b11c82225ec3faaa1

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

24 indicators of compromise · unlock with TL Creds. Compare plans

Community OSINT corroboration

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Technical analysis

On 2026-11-12 The Record reported that the FBI and DOJ disrupted cloud infrastructure used by 'FaceStealer', a social-engineering scheme the FBI attributes to APT38 (BlueNoroff). Per the FBI, the campaign stole more than $400 million in cryptocurrency over 18 months. The FBI obtained a warrant to seize more than 900 webcam videos of victims, which the operators reused to simulate meeting participants.

Initial access is a Calendly invitation to a Zoom or Teams meeting, sent from accounts stolen from earlier victims. The link leads to a fake meeting domain that delivers malware and can compromise victims before they join. Inside the fake meeting the operators play pre-recorded videos of past victims and deepfakes (including of prominent crypto figures), then present a fake technical error (for example 'cannot be heard') with a 'fix' that installs malware. The FBI describes the payload as a browser cookie harvester, keyloggers, a screen capturer and a backdoor. After compromise the actors hijack the victim's Telegram, LinkedIn, Slack and Discord accounts and approach the victim's contacts, sometimes months later. Targets are crypto-industry employees and open-source developers; the FBI cited attempts against npm and Rust crate maintainers and an earlier attempt to lure a JavaScript library maintainer into a fake Teams call.

The FBI/DOJ announcement published no domains, IPs or hashes. Independent reporting by Arctic Wolf (2026-04-27) on a BlueNoroff fake-Zoom campaign shows the same pattern: Calendly invite, typosquatted Zoom/Teams lobby with pre-recorded or AI-generated participants, covert webcam capture, an 'SDK is deprecated' ClickFix prompt, a PowerShell implant beaconing every 5 seconds, Telegram session and Chromium data theft, a COM-elevation UAC bypass and Startup LNK persistence. Arctic Wolf found over 950 media files on the operator's server. That infrastructure is included as RELATED indicators; no source confirms it is the same infrastructure the FBI disrupted.

Separately, the FBI, US Secret Service and IRS-CI attributed the Binance theft (about $6.3 billion, on or about 2026-10-29) to TraderTraitor (also Jade Sleet, Pressure Chollima, UNC4899, Slow Pisces), based partly on commingling of Binance proceeds with funds stolen from Bitget and others. Binance first cited a compromised engineer laptop, later found additional points of breach, and its CEO said the attacker used a self-destruct mechanism that destroyed tooling and traces. DOJ obtained court authorization to seize or restrain more than $1.2 billion, part of about $2.7 billion frozen by crypto platforms. Laundering uses automated wallet hopping (about 12,000 wallets, 11 blockchains, roughly 40,000 transactions per Elliptic), conversion to ETH, worthless tokens through DEX liquidity pools, bridges, mixers, instant-swap services and Chinese money-laundering networks. The FBI published a list of attacker wallet addresses; they are not reproduced in the sources reviewed here. Elliptic cautions that static wallet lists will miss funds that reach a clean wallet hours later.

The FBI states it is unclear whether FaceStealer was used in the Binance breach. FBI reporting of the Binance intrusion cites trojanized Terraform providers and the FLATROOF/ROOFDECK malware as TraderTraitor tradecraft in general (via The Hacker News); that is not tied specifically to the Binance breach.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1055 Process Injection; T1684.001 Impersonation

Execution

T1059.001 PowerShell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols

Collection

T1113 Screen Capture; T1125 Video Capture

Initial Access

T1195.002 Compromise Software Supply Chain; T1566.003 Spearphishing via Service

Lateral Movement

T1534 Internal Spearphishing

Credential Access

T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers

Persistence

T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1548.002 Bypass User Account Control

Resource Development

T1583.001 Domains; T1586.001 Social Media Accounts

Impact

T1657 Financial Theft

Remediation

Immediate actions

  • Treat unsolicited Calendly/Zoom/Teams invitations to crypto and open-source staff as hostile, even from known contacts whose accounts may be compromised; verify the meeting out of band
  • Never run clipboard-pasted commands or 'fix'/'SDK update' prompts shown inside a meeting page
  • Hunt for PowerShell cradles launched by browsers, files named chromechip.log / chrome-debug-data001.log and the 'Chrome Update - Certificated.lnk' Startup item
  • Reset sessions and credentials and revoke tokens for Telegram, LinkedIn, Slack and Discord on any suspected victim; invalidate browser cookies
  • Exchanges and DeFi operators: block transactions with or derived from wallets listed in the FBI alert on the Binance theft

Workarounds

  • Block newly registered Zoom/Teams look-alike domains at DNS and proxy
  • Use only meeting links from the vendor's own domain; join from the official client

Longer-term hardening

  • Restrict PowerShell (Constrained Language Mode, script block logging, AMSI) and alert on iwr/iex download cradles
  • Enforce hardware-bound sessions or short-lived cookies for high-value accounts to blunt cookie theft
  • Pin and verify dependencies for npm and Rust crates; protect maintainer accounts with phishing-resistant MFA
  • Use dynamic, cluster-based transaction monitoring rather than static wallet lists (Elliptic guidance)

Affected and fixed versions

  • Multiple — Crypto-industry employee endpoints and accounts (Windows, macOS, Linux)
    Vulnerable versions: Social-engineering driven; no product vulnerability
  • npm / crates.io — Open-source package maintainers (npm, Rust crates)
    Vulnerable versions: Maintainer accounts targeted
  • Binance — Exchange hot/cold wallet infrastructure
    Vulnerable versions: Engineer laptop and additional breach points per Binance

Timeline

  • TraderTraitor-attributed Bybit theft of about $1.4 billion establishes the laundering playbook later seen with Binance (The Record)
  • Arctic Wolf-documented BlueNoroff fake-Zoom intrusion of a North American Web3 firm begins (related campaign; link to FaceStealer not confirmed by sources)
  • Arctic Wolf publishes BlueNoroff ClickFix and AI-generated Zoom meeting research, including over 950 media files on operator infrastructure
  • On or about this date about $6.3 billion is stolen from Binance; the FBI later attributes it to TraderTraitor
  • FBI, Secret Service and IRS-CI attribute the Binance theft to TraderTraitor and publish attacker wallet addresses; Binance resumes withdrawals; about $2.85 billion frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism
  • FBI and DOJ announce disruption of FaceStealer cloud infrastructure (over $400 million stolen in 18 months), a warrant for over 900 victim webcam videos, and authorization to seize or restrain more than $1.2 billion of the Binance proceeds

Sources cited

More from APT38

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats