The FBI has published the playbook behind FaceStealer, a North Korean operation that uses replayed webcam footage of earlier victims to make fake Zoom and Teams calls look genuine. More than $400m in cryptocurrency has gone, and the same trick has been pointed at open-source maintainers who control widely used code.
What happened
On 12 November 2026 the FBI issued a FLASH alert on a social engineering scheme it calls FaceStealer, and the DOJ announced it had seized the cloud infrastructure behind it. The FBI says the scheme has netted more than $400m in cryptocurrency over roughly 18 months, and it has seized over 900 webcam recordings secretly captured from victims.
The FBI attributes the activity to North Korean state-sponsored operators tracked as BlueNoroff, Sapphire Sleet, APT38, UNC1069 and several other names. The same announcement separately covered more than $1.2bn seized or restrained over the Binance theft.
The tradecraft is not entirely new. Arctic Wolf has tracked it for months, and in April 2026 named the UK among the countries where victims were concentrated, alongside the US, Singapore, Hong Kong, South Korea and the UAE. Its latest count, as reported by The Hacker News, is 677 targets in 58 countries, more than 80% of them founders or senior executives.
The technical picture
FaceStealer is self-propagating: each compromised person becomes the bait for the next. The FBI describes six stages.
- Takeover. After infecting a victim, the operators hunt the device for wallets and seed phrases, seize the victim’s Telegram or similar messaging account (locking the owner out), harvest contacts and chat history, and quietly record the person on camera while they wait for a call to start.
- Trusted outreach. Posing as that victim, they message the victim’s contacts suggesting a catch-up, a collaboration or an investment chat. Real chat history lets them tailor messages to high-value targets. Hijacked and new LinkedIn, Slack and Discord accounts are also used.
- Delayed link. A Calendly-style booking is sent first, usually with no meeting link. The link arrives shortly before the call, pointing at a typosquatted domain such as uu01webzoom[.]us or teams.livemeet[.]us that serves a convincing clone of the Zoom or Teams interface. The delay limits exposure of the infrastructure.
- Replayed faces. Once the target is admitted, the operator plays the stolen webcam clip of the trusted contact, often with further clips so the room seems to hold several participants. The Hacker News reports that ChatGPT-generated headshots are also used as static avatars.
- The fake fix. After a pause, the “contact” messages the target to say their audio is not working. With several apparent attendees waiting, the target is pushed to click an update prompt, run a script or paste a command into a terminal. That installs a cookie harvester, keylogger, screen capture tooling and a backdoor. The target’s own camera has been recording since they opened the link.
- Repeat. The new victim’s footage, accounts and contact list feed the next round.
Two details deserve attention. First, patience: the FBI says that in several cases the theft came months, sometimes over a year, after the first infection, with the operators watching wallet balances on-chain and striking after large deposits. Second, the FBI says the group has started using what it calls super intelligence (SI) to generate deepfakes of prominent cryptocurrency figures, built from public photos and video, although the scheme still leans overwhelmingly on genuine stolen footage.
Why it matters for UK organisations
This is not just a crypto problem. The FBI says compromised devices are used to reach employers’ networks and open-source repository accounts. Earlier this year, according to the alert, the operators tricked the maintainer of a major JavaScript library, one with tens of millions of weekly downloads, into a fake Teams call. His access was then used to add malicious dependencies, and only quick detection averted a large supply-chain incident. npm and Rust crate maintainers have also been targeted.
For UK organisations, the exposure comes from three directions. London’s fintech and digital asset sector is an obvious target, and Arctic Wolf’s data already places the UK among the most affected countries. Any business that depends on open-source packages inherits the risk of a maintainer being compromised. And the founders and executives who make up most targets have the broadest access and the least patience for security friction.
It also undermines a common habit: treating a face on a video call as proof of identity. Finance teams that verify payments by video should take note.
Expert view
In my experience running social engineering engagements, the hardest pretext to beat is the one that arrives from a genuine account belonging to someone the target already knows. FaceStealer adds a familiar face, apparent bystanders and time pressure, which together push most people past their scepticism. None of it is technically sophisticated; it is simply good operational design.
The decisive moment is still the fake fix, the same ClickFix-style manoeuvre we have watched spread across criminal and state campaigns throughout 2026. No legitimate conferencing client asks you to paste commands into a terminal to repair your audio. If staff internalise one rule from this alert, it should be that.
The worm-like structure is what worries me most. Every victim’s recording becomes ammunition, so the operation gets more convincing with each compromise. Seizing 900-plus clips will slow it, but copies probably exist elsewhere.
What to do now
- Join calls through the official client. Open Zoom or Teams directly and enter the meeting ID rather than clicking links sent over chat apps.
- Keep the camera off until you have checked who is there. The FBI recommends talking to the person who invited you before sharing your own video, which denies the operators fresh footage.
- Ban terminal “fixes”. Tell staff plainly that no meeting tool will ask them to run scripts or paste commands. Where you can, restrict script execution and terminal access for non-technical users (Cyber Essentials: secure configuration and malware protection).
- Confirm out of band. Verify any unexpected meeting through a different channel from the one used to send the invite, such as a known phone number.
- Harden messaging accounts. Turn on multi-factor authentication, login alerts and disappearing messages on Telegram, WhatsApp, Slack and similar apps. (Cyber Essentials: user access control).
- Protect maintainers and repositories. Enforce phishing-resistant MFA on npm, crates.io and GitHub accounts, require signed and reviewed releases, and keep publishing credentials off everyday laptops.
- Separate high-value keys. Keep seed phrases and private keys off networked devices, hold only small balances in browser-extension wallets, and use hardware wallets or custodial controls for the rest.
- If someone has been caught out, move assets to a new wallet created on a clean device, reset and re-secure their messaging accounts, warn their contacts, and report it through the UK’s national fraud and cybercrime reporting service and to the NCSC.
Bottom line
FaceStealer turns the trust built into a video call into an attack. The defences are cheap and procedural: join through the official app, verify through another channel, keep the camera off until you are sure, and never run a “fix” a meeting asks for. Brief executives and developers now, before they are recruited into the next round.
Sources
- FBI IC3: North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M “FaceStealer” Crypto Theft Scheme (FLASH)
- US Department of Justice: Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency
- The Hacker News: FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls
- Decrypt: North Korea Stole $400 Million in Crypto Using Deepfake Video Calls, DOJ Says
- Patch: ‘FaceStealers’ Use Video Calls To Drain $400M From 900 Victims
