[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRAQjY52ULbCvbJWrZ95IO_Jy04bCG6A3-Jqarh4ubig":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"3f86cf5f-fc7f-467a-9b6c-8413a033de50","north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto","f93fbae7-0e0f-479e-858c-b43c086b4992","North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto","North Korea-linked threat actors (Sapphire Sleet\u002FAPT38) successfully stole over $1.2 billion in cryptocurrency by exploiting the weakest link in security: human trust. The FaceStealer scheme leveraged AI-generated deepfakes and sophisticated social engineering to trick victims into installing malware, bypassing technical controls entirely. Critically, these same actors are now targeting open-source developers, poisoning the software supply chain and threatening organizations that consume community-built tools. This incident demonstrates that even technically sophisticated environments can be compromised when users are unprepared to recognize AI-enhanced deception. As deepfake technology becomes more accessible, the credibility of social engineering attacks will only increase, making human-layer defenses a top priority.","**Immediate actions:**\n- Train all employees and developers to verify identities through out-of-band channels before installing software or sharing credentials, especially when contacted unexpectedly.\n- Audit all recently installed tools, packages, and browser extensions for signs of tampering or malicious behavior.\n- Establish a reporting pathway for staff to flag suspected deepfake or social engineering attempts without fear of blame.\n\n**Long-term improvements:**\n- Implement a vetted software allowlist so that only approved, cryptographically signed packages can be installed in developer and production environments.\n- Conduct regular tabletop exercises simulating AI-enhanced social engineering scenarios, including deepfake video and voice calls.\n- Apply supply chain security controls (e.g., SBOM tracking, dependency pinning, and integrity verification) to all open-source dependencies.\n\n**Detection measures:**\n- Deploy behavioral analytics to detect anomalous credential use or unexpected lateral movement following a potential social engineering event.\n- Monitor cryptocurrency wallets and exchange accounts for unusual transfer patterns and enforce withdrawal whitelisting and multi-approval workflows.",[12,13,14,15,16],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1195: Supply Chain Compromise","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(d)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(d)":18,"NIS2 Article 21(2)(g)":19,"MITRE ATT&CK T1566: Phishing":20,"MITRE ATT&CK T1195: Supply Chain Compromise":21,"CIS Control 14: Security Awareness and Skills Training (v8)":22},"This point mandates supply chain security measures, which would require vetting open-source dependencies and developer toolchains targeted by the North Korean actors.","This point requires organizations to maintain basic cyber hygiene and security training, which would directly address employees' ability to recognize AI-generated deepfakes and social engineering lures.","FaceStealer relied on phishing-style social engineering — including AI deepfakes — to deliver malware, which is precisely the initial access technique this ATT&CK entry covers.","Targeting open-source developers to inject malicious code into widely-used repositories is a textbook supply chain compromise, the technique this ATT&CK entry describes.","CIS Control 14 requires organizations to build and maintain a security awareness program that equips users to identify and resist social engineering attacks like the AI deepfake schemes used in FaceStealer.","published","2026-11-13T22:21:35.061148+00:00","2026-11-13T22:21:35.043+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fsecurityaffairs.com\u002F203012\u002Fcyber-crime\u002Fnorth-korea-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-infrastructure.html","north-korea-s-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-6ebed0","North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]