[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnY0-B2ZoNaJUleC3eXq-W2Aiu61sTvtHlPBY4ZllnOk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"84c0e101-94d6-4270-b79f-6e84d01a4727","north-korean-deepfake-video-calls-drain-400m-in-crypto","a38c727e-346f-40f8-a0d4-9c1ccdfcca1d","North Korean Deepfake Video Calls Drain $400M in Crypto","North Korean threat actors used AI-generated deepfake video calls and recorded videos to impersonate trusted individuals, convincing targets to install malware that stole cryptocurrency credentials and compromised systems. The root failure is a lack of security awareness: targets were unable to distinguish synthetic media from authentic communications and were socially engineered into executing malicious software. This matters because deepfake-enabled social engineering bypasses traditional technical defenses entirely, exploiting human judgment rather than software vulnerabilities. Organizations and individuals holding high-value crypto assets are prime targets, and a single successful deception can result in catastrophic, often irreversible financial loss.","**Immediate actions:**\n- Establish out-of-band verbal or in-person verification protocols before transferring assets or installing software requested via video call.\n- Train all employees and crypto asset holders to recognize deepfake indicators (unnatural blinking, lip-sync lag, lighting inconsistencies).\n- Enforce strict policies requiring multi-party approval for any cryptocurrency transactions above a defined threshold.\n\n**Long-term improvements:**\n- Implement hardware security keys (FIDO2\u002FMFA) for all accounts controlling cryptocurrency wallets to prevent malware-driven credential theft.\n- Develop and rehearse a social-engineering incident response playbook specific to high-value asset scenarios.\n- Conduct regular simulated deepfake phishing exercises to build organizational resilience against synthetic-media attacks.\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tools to flag unusual processes spawned after video-call sessions.\n- Monitor wallet transaction logs for anomalous or unauthorized outbound transfers in real time.\n- Integrate threat intelligence feeds covering North Korean TTPs (TraderTraitor, FaceStealer) into your SIEM for early-warning alerting.",[12,13,14,15,16],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1204: User Execution","NIS2 Article 21(2)(g)","NIS2 Article 21(2)(j)","CIS Control 14: Security Awareness and Skills Training (v8)",{"NIS2 Article 21(2)(g)":18,"NIS2 Article 21(2)(j)":19,"MITRE ATT&CK T1566: Phishing":20,"MITRE ATT&CK T1204: User Execution":21,"CIS Control 14: Security Awareness and Skills Training (v8)":22},"This point requires basic cyber hygiene and training for staff, which would have equipped targets to recognize and resist deepfake-based social engineering before installing malware.","Mandatory multi-factor authentication and secured communications channels would have added a verification layer that deepfake video calls alone could not satisfy, limiting unauthorized access and transactions.","The attackers used deepfake video calls as a phishing vector to manipulate targets into installing malware, which is exactly the social-engineering initial-access technique this entry covers.","Victims were tricked into manually executing malicious software delivered through the deepfake interaction, the precise user-execution technique this entry describes.","This control explicitly requires organizations to train users to identify and resist social-engineering attacks, the primary defense that failed when targets were deceived by synthetic video personas.","published","2026-11-13T16:23:15.679554+00:00","2026-11-13T16:23:15.645+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Ffbi-says-north-korean-hackers-stole.html","fbi-says-north-korean-hackers-stole-over-400-million-in-crypto-using-deepfake-vi-d32b5f","FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"deception","Deception and honeypots","An attacker who gets in quietly can explore the network for weeks before any alarm goes off.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]