InfoSecBulletin Cybersecurity for mankind
The United States Justice Department said Thursday it had seized cloud infrastructure used by North Korean hackers in a video-call scam that has stolen more than $400 million (€361 million) in cryptocurrency over 18 months. It also said it had court approval to seize or restrain more than $1.2 billion taken in the recent Binance hack.
What do we know?
North Korean hackers steal more than $400 million using video images, FBI says
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
The Federal Bureau of Investigation calls the scam “FaceStealer.”
According to the Justice Department, hackers sent meeting invitations from accounts taken over from earlier victims. Once a target joins, the hackers record their webcam video and play a prerecorded clip of a previous victim the target knows, so trusted contacts appear to be present. The FBI says hackers are also starting to use AI-generated deepfakes of well-known crypto figures.
The hackers then stage a fake technical error and offer a link to “fix” it, which installs malware, the department said. In some cases, they waited months, or over a year, before stealing funds.
After that, they use the victim’s contacts to find new targets.
Who were the targets of the scam?
Most targets work in crypto and other internet-related fields, and the hackers are increasingly going after open-source software developers, apparently to enable supply-chain attacks, the department said.
Under a federal warrant, the FBI seized more than 900 webcam videos of victims.
“If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” said Patrick Grandy, who heads the FBI’s Los Angeles field office.
The FBI ties FaceStealer to a hacking cluster known as Sapphire Sleet or UNC1069. It is separate from the North Korean military hackers blamed for the Binance theft.
What happened to Binance?
In the Binance case, the FBI said the group known as TraderTraitor stole more than $6 billion (5.4 billion euros) on or around October 29. AP put the figure at about $6.3 billion (5.7 billion euros) and called it the biggest crypto heist on record. US agencies and private firms have since frozen more than $2.7 billion (2.44 billion euros), the department said.
Authorities usually file a forfeiture claim in court, after which a judge decides who has a rightful claim to the recovered funds, AP reported.
“North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft,” said M. Scott Proctor, the department’s principal deputy assistant attorney general for national security.
