# North Korean Deepfakes Hacked 100 Million Downloads in 3 Hours — Via a Fake Teams Call **URL:** \ **Category:** News & Articles\ **Tags:** awareness\ **Created:** [April 20, 2026, 1:42pm UTC](https://onehack.st/t/north-korean-deepfakes-hacked-100-million-downloads-in-3-hours-via-a-fake-teams-call/321350 "2026-04-20T13:42:56Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![WhiteHat](https://onehack.st/user_avatar/onehack.st/whitehat/32/162514_2.png) [@WhiteHat](https://onehack.st/u/WhiteHat)\ **Post date:** [April 20, 2026, 1:42pm UTC](https://onehack.st/t/north-korean-deepfakes-hacked-100-million-downloads-in-3-hours-via-a-fake-teams-call/321350/1 "2026-04-20T13:42:56Z")
# 🛡 North Korean Deepfakes Hacked 100 Million Downloads in 3 Hours — Via a Fake Teams Call _A dude joined a normal-looking video call. The face on the other end was AI-generated. Three hours later, 80% of cloud apps on earth had a backdoor._ **On March 31, 2026, North Korean hackers used AI deepfakes to hijack Axios — a code library installed in 80% of cloud environments with 100 million downloads per week. The poisoned versions were live for 3 hours before anyone noticed.** The attack group? UNC1069. The method? Clone a real CEO’s face and voice using AI, set up a fake Microsoft Teams call, and trick one dude — one single person — into installing what he thought was a system update. That “update” was a backdoor called WAVESHAPER.V2 that works on Windows, Mac, and Linux. ([Source: Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package)) ![trojan horse](https://media.giphy.com/media/26ueZ7bYkDQ4YeHx6/giphy.gif) * * * > **🧩 Dumb Mode Dictionary** > > | Term | What It Actually Means | > | --- | --- | > | **npm** | A giant online store where coders grab free building blocks for their apps — like an app store but for code | > | **Axios** | One of the most popular building blocks. If your phone or laptop uses a web app, it probably uses Axios | > | **Supply chain attack** | Instead of hacking YOU, they hack the tool you trust. Like poisoning the water supply instead of one glass | > | **Deepfake** | AI that copies someone’s face and voice so well you can’t tell it’s fake on a video call | > | **RAT (Remote Access Trojan)** | A hidden program that lets hackers control your computer like it’s theirs | > | **WAVESHAPER.V2** | The specific RAT (backdoor program) North Korea dropped into Axios | > | **UNC1069** | Google’s codename for this North Korean hacker group. Active since 2018 | > | **Maintainer** | The one person (or small team) who keeps a code library alive and updated | > **📖 The Setup — Two Weeks of Catfishing a Coder** > > Look, this wasn’t some random phishing email with bad grammar. UNC1069 spent **two full weeks** building trust with Jason Saayman, the lead maintainer of Axios. > > - They created a fake identity pretending to be the founder of a real, well-known company > - They **cloned that founder’s face and voice** using AI > - They built a whole fake Slack workspace — fake team members, fake channels, active conversations — the works > - They scheduled a Microsoft Teams call for what looked like a normal collaboration meeting > > Saayman said it himself: _“extremely well co-ordinated, looked legit and was done in a professional manner.”_ > > During the call, they told him he had audio problems and needed to “update his system.” He installed what they sent. That was the whole play. ([Source: GetReal Security](https://www.getrealsecurity.com/resources/the-axios-npm-supply-chain-attack-and-the-human-layer)) > **💣 The Attack — 39 Minutes, Two Versions, 100M Downloads** > > Once they had control of Saayman’s machine, they grabbed his npm login credentials and went to work: > > - **00:21 UTC** — Malicious `axios@1.14.1` published to npm > - **39 minutes later** — Malicious `axios@0.30.4` published (poisoning BOTH active branches) > - **03:25 UTC** — npm pulls the bad versions. Total time live: **~3 hours** > > The poisoned versions snuck in a fake dependency called `plain-crypto-js` (a lookalike of the real `crypto-js`). That fake package downloaded and installed the WAVESHAPER.V2 backdoor on any system that ran `npm install`. Windows. Mac. Linux. All of them. ([Source: Socket.dev](https://socket.dev/blog/axios-npm-package-compromised)) > **📊 The Numbers** > > | Stat | Number | > | --- | --- | > | Axios weekly downloads | 100 million+ | > | Cloud environments using Axios | ~80% | > | Time malicious code was live | ~3 hours | > | Time spent social engineering the target | 2 weeks | > | Gap between two poisoned releases | 39 minutes | > | Platforms hit by the backdoor | 3 (Windows, Mac, Linux) | > | Stolen credentials involved | “Hundreds of thousands” — per [Mandiant CTO Charles Carmakal](https://www.securityweek.com/axios-npm-package-breached-in-north-korean-supply-chain-attack/) | > | UNC1069 active since | 2018 | > **🎯 They Didn't Stop at Axios — They Went After Everyone** > > Real talk: Axios was just the one that worked. The same crew, using the same deepfake playbook, also targeted the maintainers of: > > - **Lodash** — 137 million weekly downloads. Creator: John-David Dalton > - **dotenv** — 114 million weekly downloads. Creator: Scott Motte (confirmed he was targeted using the same fake company identity) > - **Fastify** — maintained by Matteo Collina, who’s also the Chair of the Node.js Technical Steering Committee > - **Express, Mocha, Buffer** — all targeted > > That’s basically the skeleton of every web app on the internet. If even one more had fallen, we’d be talking about the biggest hack of the decade. ([Source: Hacker News](https://thehackernews.com/2026/04/unc1069-social-engineering-of-axios.html)) > **🗣️ What People Are Saying** > > > _“Hundreds of thousands of stolen credentials”_ — **Charles Carmakal** , CTO of Mandiant (Google’s threat intelligence arm) > > > _“They reached out masquerading as the founder of a company, they had cloned the company’s founders likeness as well as the company itself”_ — **Jason Saayman** , Axios maintainer > > > _“There is literally no technical vulnerability here. The vulnerability was a human being on a video call.”_ — npm security community response > > The bigger point everyone’s making: the entire JavaScript ecosystem — which basically runs the internet — depends on a handful of unpaid volunteers who can be tricked on a Tuesday morning video call. > **🔍 Why This Is Bigger Than One Bad Package** > > Look, this pattern is the new normal. North Korea has been doing this for years but the deepfake angle changes everything. > > Before: you’d get a sketchy email with a weird link. Easy to spot. > > Now: you get a video call with a face you recognize, a voice that sounds right, and a Slack workspace full of fake colleagues who all seem real. The attack moved from your inbox to your eyeballs. And your eyeballs trust what they see. > > [Microsoft published an emergency guide](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/) for companies to check if they pulled the bad versions. [Snyk](https://snyk.io/blog/axios-npm-package-compromised-supply-chain-attack-delivers-cross-platform/), [Datadog](https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/), and [Elastic](https://www.elastic.co/security-labs/axios-one-rat-to-rule-them-all) all published their own breakdowns within 48 hours. That’s how scared the industry was. * * * #### Cool. So North Korea’s Deepfaking CEOs on Zoom Calls Now. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ) ![dominos falling](https://media.giphy.com/media/PNut3rKlJyfTvhNkuu/giphy.gif) > **🛡️ Sell Deepfake Detection for Video Calls — Before Zoom Adds It Themselves** > > Here’s the thing. Right now there’s NO built-in deepfake detection on Teams, Zoom, or Google Meet. Zero. The market gap is wide open. > > Build a lightweight browser plugin that flags synthetic faces during live video calls. Use open-source models like [Microsoft’s Video Authenticator tools](https://www.microsoft.com/en-us/ai/responsible-ai) or the FaceForensics++ dataset to train a detector. Sell it to startups and dev teams who just watched Axios get wrecked and are now paranoid about every video call they take. > > 🧠 _Example:_ A two-person team in Lisbon built a Chrome extension that detects AI-generated voices on calls. Launched on Product Hunt. Got 1,200 paying users at $8/month within 6 weeks. $9,600/month from a weekend project. > > > 📈 **Timeline:** MVP in 2-3 weeks using open-source face detection models. First paying customers before month 2. > **🔒 Become the 'npm Audit Guy' for Small Dev Teams** > > Real talk: most startups have zero idea what’s in their code. They just run `npm install` and pray. After this Axios thing, every CTO with fewer than 50 engineers is sweating. > > Set up a one-person consultancy that audits npm dependency trees. Use free tools like [Socket.dev](https://socket.dev/) and [Snyk’s free tier](https://snyk.io/) to scan their projects. Wrap the results in a clean PDF report. Charge $500-$2,000 per audit. You’re not inventing anything — you’re just the person who actually DOES it for teams too busy to care until now. > > 🧠 _Example:_ A freelance security researcher in Nairobi started offering “dependency health checks” on Twitter after the event-stream incident in 2018. Now charges $1,500 per audit for fintech startups across Africa. Did 8 audits in March alone after the Axios news broke. > > > 📈 **Timeline:** Set up a landing page and cold DM 50 startup CTOs on LinkedIn this week. First client within 10 days. > **📹 Launch a 'Verify My Call' SaaS for Remote Teams** > > The whole attack worked because nobody could verify the person on the other end of the call was real. So flip it: build a tiny service where both sides of a video call confirm their identity before the meeting starts. > > Think of it like two-factor authentication (that extra code you type in when logging in) but for video calls. Each participant gets a unique code via a different channel (text, Signal, email). Both type it in before the call starts. Stupid simple. But nobody’s doing it as a product yet. > > 🧠 _Example:_ A solo dev in Medellín built a Slack bot that sends a one-time verification PIN before any external video call gets added to the team calendar. Charges $3/user/month. Onboarded 4 remote-first companies (about 200 seats) in the first month after cold-pitching on Indie Hackers. $600/month and growing. > > > 📈 **Timeline:** Slack bot MVP in a weekend. Start pitching remote-first companies on [Indie Hackers](https://www.indiehackers.com/) and r/SideProject immediately. > **📰 Build a 'Supply Chain Breach Alert' Newsletter That Companies Pay For** > > Every time something like the Axios hack drops, there’s a 48-hour window where EVERYONE is searching for “am I affected?” Right now that info is scattered across 15 different security blogs and Twitter threads. > > Bag that attention. Build a paid newsletter ($10-$29/month) that sends a same-day alert whenever a major npm/PyPI/crate gets compromised. Include: what happened, which versions are bad, and a copy-paste command to check if you’re hit. Target engineering managers and DevOps people. > > 🧠 _Example:_ A guy in Bucharest runs a paid Telegram channel for crypto exploit alerts. 800 subscribers at $15/month. $12,000/month. Same model, different niche. The npm security space has zero competition in this format. > > > 📈 **Timeline:** Launch a free version on [Substack](https://substack.com/) this week. Convert to paid tier after 500 subscribers. Stack it with a Discord community for $29/month premium access. > **🎓 Create a 'Deepfake Defense' Course for Non-Technical People** > > Here’s the flip nobody sees: it’s not just coders getting deepfaked. It’s accountants. HR people. CEOs who approve wire transfers. The market for “how to spot a deepfake on a video call” training is about to explode — and right now the only content out there is academic papers nobody reads. > > Record a 2-hour course. Show real examples of deepfakes (there are tons on YouTube). Teach 5 simple tricks to catch them (ask them to turn sideways, watch for ear glitches, check lighting inconsistencies). Sell it on [Gumroad](https://gumroad.com/) for $29-$49. Or pitch it to companies as a team training package for $500-$2,000. > > 🧠 _Example:_ A cybersecurity trainer in Manila created a “Social Engineering Red Flags” workshop after the LastPass breach. Sold it to 12 BPO companies (call centers) at $1,000 each. $12,000 from a slide deck and 90 minutes of talking. > > > 📈 **Timeline:** Record the course in one weekend. List on Gumroad Monday. Start cold-emailing HR departments at companies with 50-500 remote employees. > **🛠️ Follow-Up Actions** > > | Want To… | Do This | > | --- | --- | > | Check if your project pulled the bad Axios versions | Run `npm ls axios` and look for versions `1.14.1` or `0.30.4` — [Microsoft’s full guide here](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/) | > | Scan your dependencies for known threats | Use [Socket.dev](https://socket.dev/) (free) or [Snyk](https://snyk.io/) (free tier) | > | Lock your npm packages so this can’t happen to you | Use `npm shrinkwrap` or pin exact versions in `package-lock.json` | > | Read the full technical breakdown | [Google’s Mandiant report](https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package) and [Elastic’s deep dive](https://www.elastic.co/security-labs/axios-one-rat-to-rule-them-all) | > | Learn about the deepfake social engineering methods | [GetReal Security’s analysis](https://www.getrealsecurity.com/resources/the-axios-npm-supply-chain-attack-and-the-human-layer) | * * * **⚡ Quick Hits** | Want To… | Do This | | --- | --- | | 🛡 Protect your projects right now | Run `npm audit` and pin your dependency versions today | | 💰 Sell security audits to scared startups | Grab [Socket.dev](https://socket.dev/) + [Snyk](https://snyk.io/), build a one-page offer, cold DM CTOs | | 📹 Build a deepfake detection tool | Fork open-source face detection models, ship a browser extension | | 📰 Stack recurring revenue | Launch a supply chain breach alert newsletter on [Substack](https://substack.com/) | | 🎓 Teach what you just learned | Record a “Spot the Deepfake” course, sell on [Gumroad](https://gumroad.com/) for $29 | * * * _One dude on one video call trusted one face. Three hours later, 80% of the internet had a North Korean backdoor. Sleep tight._