FaceStealer fake calls net North Korea $400M

Video is no longer proof of identity, and the assumption that seeing a familiar face on a call guarantees trust has completely collapsed. When nation-state actors weaponize stolen webcam feeds into self-replicating social engineering pipelines, routine developer syncs become critical attack vectors.

• –Attackers secretly recorded every victim to build a 900-video library, continuously recycling trusted faces to compromise adjacent contacts across developer networks.
• –Open-source software maintainers and Web3 developers were specifically targeted for their elevated access to code repositories, private keys, and build pipelines.
• –The social engineering exploited standard developer habits, using simulated audio failures to coax victims into executing malicious "fixes" and terminal commands.
• –Pre-recorded webcam footage combined with imposter conferencing domains proved more convincing and resilient than raw real-time generative deepfakes.
• –Engineering teams must adopt out-of-band verification and hardware-backed auth rather than trusting visual or audio recognition during impromptu meetings.