North Korean Deepfakes Hacked 100 Million Downloads in 3 Hours — Via a Fake Teams Call
North Korean Deepfakes Hacked 100 Million Downloads in 3 Hours — Via a Fake Teams CallA dude joined a normal-looking video call. The face on the other end was AI-generated. Three hours later, 80% of cloud apps on earth had a backdoor.
On March 31, 2026, North Korean hackers used AI deepfakes to hijack Axios — a code library installed in 80% of cloud environments with 100 million downloads per week. The poisoned versions were live for 3 hours before anyone noticed.
The attack group? UNC1069. The method? Clone a real CEO’s face and voice using AI, set up a fake Microsoft Teams call, and trick one dude — one single person — into installing what he thought was a system update. That “update” was a backdoor called WAVESHAPER.V2 that works on Windows, Mac, and Linux. (Source: Google Threat Intelligence)
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| npm | A giant online store where coders grab free building blocks for their apps — like an app store but for code |
| Axios | One of the most popular building blocks. If your phone or laptop uses a web app, it probably uses Axios |
| Supply chain attack | Instead of hacking YOU, they hack the tool you trust. Like poisoning the water supply instead of one glass |
| Deepfake | AI that copies someone’s face and voice so well you can’t tell it’s fake on a video call |
| RAT (Remote Access Trojan) | A hidden program that lets hackers control your computer like it’s theirs |
| WAVESHAPER.V2 | The specific RAT (backdoor program) North Korea dropped into Axios |
| UNC1069 | Google’s codename for this North Korean hacker group. Active since 2018 |
| Maintainer | The one person (or small team) who keeps a code library alive and updated |
📖 The Setup — Two Weeks of Catfishing a Coder
Look, this wasn’t some random phishing email with bad grammar. UNC1069 spent two full weeks building trust with Jason Saayman, the lead maintainer of Axios.
- They created a fake identity pretending to be the founder of a real, well-known company
- They cloned that founder’s face and voice using AI
- They built a whole fake Slack workspace — fake team members, fake channels, active conversations — the works
- They scheduled a Microsoft Teams call for what looked like a normal collaboration meeting
Saayman said it himself: “extremely well co-ordinated, looked legit and was done in a professional manner.”
During the call, they told him he had audio problems and needed to “update his system.” He installed what they sent. That was the whole play. (Source: GetReal Security)
💣 The Attack — 39 Minutes, Two Versions, 100M Downloads
Once they had control of Saayman’s machine, they grabbed his npm login credentials and went to work:
- 00:21 UTC — Malicious
[email protected]published to npm - 39 minutes later — Malicious
[email protected]published (poisoning BOTH active branches) - 03:25 UTC — npm pulls the bad versions. Total time live: ~3 hours
The poisoned versions snuck in a fake dependency called plain-crypto-js (a lookalike of the real crypto-js). That fake package downloaded and installed the WAVESHAPER.V2 backdoor on any system that ran npm install. Windows. Mac. Linux. All of them. (Source: Socket.dev)
📊 The Numbers
| Stat | Number |
|---|---|
| Axios weekly downloads | 100 million+ |
| Cloud environments using Axios | ~80% |
| Time malicious code was live | ~3 hours |
| Time spent social engineering the target | 2 weeks |
| Gap between two poisoned releases | 39 minutes |
| Platforms hit by the backdoor | 3 (Windows, Mac, Linux) |
| Stolen credentials involved | “Hundreds of thousands” — per Mandiant CTO Charles Carmakal |
| UNC1069 active since | 2018 |
🎯 They Didn't Stop at Axios — They Went After Everyone
Real talk: Axios was just the one that worked. The same crew, using the same deepfake playbook, also targeted the maintainers of:
- Lodash — 137 million weekly downloads. Creator: John-David Dalton
- dotenv — 114 million weekly downloads. Creator: Scott Motte (confirmed he was targeted using the same fake company identity)
- Fastify — maintained by Matteo Collina, who’s also the Chair of the Node.js Technical Steering Committee
- Express, Mocha, Buffer — all targeted
That’s basically the skeleton of every web app on the internet. If even one more had fallen, we’d be talking about the biggest hack of the decade. (Source: Hacker News)
🗣️ What People Are Saying
“Hundreds of thousands of stolen credentials” — Charles Carmakal, CTO of Mandiant (Google’s threat intelligence arm)
“They reached out masquerading as the founder of a company, they had cloned the company’s founders likeness as well as the company itself” — Jason Saayman, Axios maintainer
“There is literally no technical vulnerability here. The vulnerability was a human being on a video call.” — npm security community response
The bigger point everyone’s making: the entire JavaScript ecosystem — which basically runs the internet — depends on a handful of unpaid volunteers who can be tricked on a Tuesday morning video call.
🔍 Why This Is Bigger Than One Bad Package
Look, this pattern is the new normal. North Korea has been doing this for years but the deepfake angle changes everything.
Before: you’d get a sketchy email with a weird link. Easy to spot.
Now: you get a video call with a face you recognize, a voice that sounds right, and a Slack workspace full of fake colleagues who all seem real. The attack moved from your inbox to your eyeballs. And your eyeballs trust what they see.
Microsoft published an emergency guide for companies to check if they pulled the bad versions. Snyk, Datadog, and Elastic all published their own breakdowns within 48 hours. That’s how scared the industry was.
Cool. So North Korea’s Deepfaking CEOs on Zoom Calls Now. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)
🛡️ Sell Deepfake Detection for Video Calls — Before Zoom Adds It Themselves
Here’s the thing. Right now there’s NO built-in deepfake detection on Teams, Zoom, or Google Meet. Zero. The market gap is wide open.
Build a lightweight browser plugin that flags synthetic faces during live video calls. Use open-source models like Microsoft’s Video Authenticator tools or the FaceForensics++ dataset to train a detector. Sell it to startups and dev teams who just watched Axios get wrecked and are now paranoid about every video call they take.
Example: A two-person team in Lisbon built a Chrome extension that detects AI-generated voices on calls. Launched on Product Hunt. Got 1,200 paying users at $8/month within 6 weeks. $9,600/month from a weekend project.
Timeline: MVP in 2-3 weeks using open-source face detection models. First paying customers before month 2.
🔒 Become the 'npm Audit Guy' for Small Dev Teams
Real talk: most startups have zero idea what’s in their code. They just run npm install and pray. After this Axios thing, every CTO with fewer than 50 engineers is sweating.
Set up a one-person consultancy that audits npm dependency trees. Use free tools like Socket.dev and Snyk’s free tier to scan their projects. Wrap the results in a clean PDF report. Charge $500-$2,000 per audit. You’re not inventing anything — you’re just the person who actually DOES it for teams too busy to care until now.
Example: A freelance security researcher in Nairobi started offering “dependency health checks” on Twitter after the event-stream incident in 2018. Now charges $1,500 per audit for fintech startups across Africa. Did 8 audits in March alone after the Axios news broke.
📹 Launch a 'Verify My Call' SaaS for Remote Teams
The whole attack worked because nobody could verify the person on the other end of the call was real. So flip it: build a tiny service where both sides of a video call confirm their identity before the meeting starts.
Think of it like two-factor authentication (that extra code you type in when logging in) but for video calls. Each participant gets a unique code via a different channel (text, Signal, email). Both type it in before the call starts. Stupid simple. But nobody’s doing it as a product yet.
Example: A solo dev in Medellín built a Slack bot that sends a one-time verification PIN before any external video call gets added to the team calendar. Charges $3/user/month. Onboarded 4 remote-first companies (about 200 seats) in the first month after cold-pitching on Indie Hackers. $600/month and growing.
📰 Build a 'Supply Chain Breach Alert' Newsletter That Companies Pay For
Every time something like the Axios hack drops, there’s a 48-hour window where EVERYONE is searching for “am I affected?” Right now that info is scattered across 15 different security blogs and Twitter threads.
Bag that attention. Build a paid newsletter ($10-$29/month) that sends a same-day alert whenever a major npm/PyPI/crate gets compromised. Include: what happened, which versions are bad, and a copy-paste command to check if you’re hit. Target engineering managers and DevOps people.
Example: A guy in Bucharest runs a paid Telegram channel for crypto exploit alerts. 800 subscribers at $15/month. $12,000/month. Same model, different niche. The npm security space has zero competition in this format.
🎓 Create a 'Deepfake Defense' Course for Non-Technical People
Here’s the flip nobody sees: it’s not just coders getting deepfaked. It’s accountants. HR people. CEOs who approve wire transfers. The market for “how to spot a deepfake on a video call” training is about to explode — and right now the only content out there is academic papers nobody reads.
Record a 2-hour course. Show real examples of deepfakes (there are tons on YouTube). Teach 5 simple tricks to catch them (ask them to turn sideways, watch for ear glitches, check lighting inconsistencies). Sell it on Gumroad for $29-$49. Or pitch it to companies as a team training package for $500-$2,000.
Example: A cybersecurity trainer in Manila created a “Social Engineering Red Flags” workshop after the LastPass breach. Sold it to 12 BPO companies (call centers) at $1,000 each. $12,000 from a slide deck and 90 minutes of talking.
🛠️ Follow-Up Actions
| Want To… | Do This |
|---|---|
| Check if your project pulled the bad Axios versions | Run npm ls axios and look for versions 1.14.1 or 0.30.4 — Microsoft’s full guide here |
| Scan your dependencies for known threats | Use Socket.dev (free) or Snyk (free tier) |
| Lock your npm packages so this can’t happen to you | Use npm shrinkwrap or pin exact versions in package-lock.json |
| Read the full technical breakdown | Google’s Mandiant report and Elastic’s deep dive |
| Learn about the deepfake social engineering methods | GetReal Security’s analysis |
Quick Hits
| Want To… | Do This |
|---|---|
| Protect your projects right now |
Run npm audit and pin your dependency versions today |
 Sell security audits to scared startups |
Grab Socket.dev + Snyk, build a one-page offer, cold DM CTOs |
 Build a deepfake detection tool |
Fork open-source face detection models, ship a browser extension |
 Stack recurring revenue |
Launch a supply chain breach alert newsletter on Substack |
 Teach what you just learned |
Record a “Spot the Deepfake” course, sell on Gumroad for $29 |
One dude on one video call trusted one face. Three hours later, 80% of the internet had a North Korean backdoor. Sleep tight.
!