FBI Disrupts FaceStealer: North Korea's Fake Call Scheme
Quick answer. On November 12, 2026, the FBI and DOJ said they seized infrastructure behind FaceStealer, a North Korean fake video-call scheme blamed for over $400 million in crypto theft. It hijacks contacts' accounts, replays stolen webcam videos and now targets open-source maintainers.
Video transcript
North Korean operators fake video calls from trusted contacts to steal crypto. On November 12, 2026, the FBI said it seized their infrastructure.
Officials say FaceStealer stole more than 400 million dollars in crypto over 18 months. How that was calculated is not disclosed.
A hijacked account sends an invite, then a fake meeting link. An earlier victim's recorded video plays while you are recorded. A fake audio fault prompts you to run a fix, and the cycle repeats.
The FBI seized more than 900 webcam videos used to impersonate past victims. Deepfakes are emerging, but the campaign relies overwhelmingly on stolen footage. A familiar face is not verification.
The malware can install cookie harvesters, keyloggers, screen capture and a backdoor. Theft can come months to more than a year later, so date exposure from the meeting.
FaceStealer increasingly targets open-source maintainers. The FBI describes a failed attempt to add malicious dependencies to an unnamed JavaScript library with tens of millions of weekly downloads.
Join through the official app, keep the webcam off until verified, and confirm invites on a second channel. Refuse any fix offered on a call. If compromised, create a new wallet on a clean device.
Read the full article for FBI guidance. Guardian's blockchain pentest tests whether a compromised pipeline, registry or cloud account could ship code or reach signing systems.
What Happened
On November 12, 2026, the Justice Department said the FBI had seized cloud infrastructure used by FaceStealer, a North Korean fake video-call campaign. U.S. Department of Justice, FBI Internet Crime Complaint Center, Federal Bureau of Investigation
Officials say the scheme stole more than $400 million in cryptocurrency over the prior 18 months. GMA News Online, Reuters, NBC Los Angeles
Under a federal warrant, the FBI also seized more than 900 webcam videos. Operators used them to impersonate earlier victims in new attacks. Nextgov/FCW, Help Net Security
The FBI published FLASH advisory AC-111226-MS the same day. It sets out the attack chain, the malware and recommended defenses.
The FBI also says the campaign increasingly targets open-source developers and maintainers, to reach their repository accounts.
That moves the risk from one person's wallet to every project that installs their code.
Who the FBI Blames
The FBI attributes FaceStealer to North Korean clusters publicly tracked as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. FBI Internet Crime Complaint Center
Reuters, reporting the FBI's statement, used a shorter label: Sapphire Sleet or UNC1069. Either way, attribution is an official assessment, not a court finding against each named cluster. GMA News Online, Reuters
How a FaceStealer Call Works
The lure comes from someone the target already knows. Operators hijack Telegram, LinkedIn, Slack, Discord or other accounts, then use their chat histories to pick and approach contacts. U.S. Department of Justice, FBI Internet Crime Complaint Center, Nextgov/FCW, Help Net Security
The FBI says a Calendly or similar invite sets the time. The fake link, on domains such as uu01webzoom[.]us or teams.livemeet[.]us, arrives from the hijacked account shortly before the call.
The FBI FLASH describes six stages, summarized below.
| Stage | What happens |
|---|---|
| 1. Victim A compromised | A contact's messaging account is taken over |
| 2. Hijacked account invites | The hijacked account invites the contact to a meeting |
| 3. Calendly, then fake link | Typo-squatted Zoom or Teams link, sent shortly before the call, opens a fake meeting |
| 4. Recorded video plays | An earlier victim's webcam video plays while the target is recorded |
| 5. Fake fix, self-infection | A fake audio fault prompts an update, script or terminal command |
| 6. Cycle repeats | Recorded videos and hijacked accounts feed follow-on attacks |
What the Malware Does
The FBI says the payload can install browser-cookie harvesters, keyloggers, screen capture and a backdoor. U.S. Department of Justice, FBI Internet Crime Complaint Center, Nextgov/FCW, Help Net Security
Stolen session cookies can let an attacker reuse logged-in sessions without the password. Keyloggers and screen capture collect what cookies miss.
Theft can be delayed. In several reported cases, crypto was stolen or chat accounts hijacked months to more than a year after the first infection.
The FBI says operators waited for wallet balances to grow, then reconstituted wallets from copied seed phrases.
So a clean scan today says little about a call taken last spring. Date your exposure from the meeting, not from the theft.
The Open-Source Near-Miss
The FBI says that earlier this year a maintainer of a significant JavaScript library was lured into a fake Teams call that included someone he recognized. FBI Internet Crime Complaint Center
The attackers then used his access to create malicious dependencies that would download with the library, which gets tens of millions of downloads a week.
The FBI calls it a failed attack, stopped by quick detection and response. It does not name the library or say whether any user installed a bad version.
The FBI says it also knows of other attempts against npm maintainers and, recently, Rust crate maintainers.
A new dependency is quieter than a rewritten file. Reviewers reading the library's own code may never open what it pulls in.
Our axios npm attack explainer covers a March 2026 case with the same pattern: a fake Teams call, a maintainer's laptop and one added dependency. The FBI does not say whether that is the case it describes. axios project, GitHub, The Record from Recorded Future News
Our chalk and debug npm compromise explainer shows what happens downstream when a phished maintainer account does publish.
Deepfakes Are Not the Main Tool
The FBI calls deepfake video an emerging technique. It says the campaign still relies overwhelmingly on genuine stolen footage of victims. FBI Internet Crime Complaint Center, Help Net Security
The FBI says deepfakes depict well-known crypto and web3 figures, and only need to pass as webcam video. U.S. Department of Justice
The DOJ release mentions super intelligence in deepfake production but names no model, provider or technical threshold.
The lesson holds either way: a familiar face on a call is not verification.
What Is Still Unclear
Arctic Wolf, quoted by Nextgov, says it has identified more than 677 targets across 58 countries. These are its figures, not the FBI's. Nextgov/FCW
Not disclosed: how the loss estimate was calculated, who the victims were, or what each one lost.
A seizure disrupts infrastructure. It does not show that every operator, domain, account or copy of the video library is gone.
The Binance action is separate. DOJ described more than $1.2 billion in court-authorized seizure or restraint tied to the October 29 theft. U.S. Department of Justice
That sum is not a final forfeiture and is not part of the FaceStealer total. Our Binance hack explainer covers that incident.
What Changed
Fake meeting lures against crypto staff are not new. Our fake Zoom meeting scams guide covers earlier cases and Zoom hardening.
What is new is federal action against the infrastructure, and an FBI warning that maintainers, not just wallet holders, are now targets. U.S. Department of Justice, FBI Internet Crime Complaint Center
Developers face a parallel lure in fake job interviews and malicious coding tests, which end in the same stolen keys and tokens.
What Teams Should Do Now
Treat the meeting, the laptop, the chat accounts and the repositories as one attack path.
Signers need stricter rules than other staff. See social engineering attacks on multisig signers, and our crypto OpSec baseline for devices and accounts.
- Join through the official Zoom or Teams app with an invite code, not a link sent in chat. FBI Internet Crime Complaint Center, Help Net Security
- Keep the webcam off until you have confirmed who invited you.
- Confirm every invite on a second channel you choose, even from a known contact.
- Refuse any script, update or pasted terminal command offered during a call.
- After a suspected compromise, create a new wallet with a fresh seed phrase on a clean device, then move assets.
- Enable MFA and login alerts, change passwords, end active sessions and secure messaging and developer accounts.
- Warn your contacts, then report to IC3.gov using the keyword FaceStealer.
- Keep browser-extension wallet balances small and keep recovery phrases off devices.
- Isolate any laptop that ran a meeting fix, and rotate the SSH keys and registry tokens it held.
- Review who can publish your packages, and check recent releases for unexpected dependencies.
Guardian Analysis: Repositories Hold Secrets
This section is Guardian analysis. FaceStealer reaches repositories through a maintainer's laptop, so what those repositories hold sets the blast radius.
Guardian's public Synthetix Auto-Compounding LP Vault report records finding M-07, rated Medium. A SECRET_ARN value and an Alchemy RPC key were committed in plaintext. Guardian Audits
The finding states that anyone with repository access could extract production secrets or drain paid API quotas.
The main review lists M-07 as Resolved. Its remediation review records L-08 as Acknowledged: Synthetix said SECRET_ARN only identifies the key, but the RPC URL remained exposed in config.ts.
Repository access is what FaceStealer sought from the JavaScript maintainer. FBI Internet Crime Complaint Center
The finding is not evidence that FaceStealer touched Synthetix or any other project.
Our Web3 SDK security testing guide sets out the release checks: diff source against the published package, and review new dependencies and install scripts. Guardian Resource Hub
It also covers restricting registry and CI permissions, pinning versions and rehearsing a package withdrawal. Together these limit what one compromised maintainer laptop can ship.
Frequently Asked Questions
Where can FaceStealer victims find FBI guidance?
DOJ says the FBI created www.fbi.gov/facestealer as a centralized hub for resources and information on the scheme. The FBI's FLASH also advises telling your employer when work devices or files may be compromised. U.S. Department of Justice, FBI Internet Crime Complaint Center
Which agencies took part in the FaceStealer actions?
DOJ says the FaceStealer disruption was led by the US Attorney's Office for the Central District of California and the FBI's Los Angeles Field Office. The other offices it names worked on the separate Binance action. U.S. Department of Justice
Is FaceStealer limited to video calls?
No. Arctic Wolf's Justin Moore told Nextgov the playbook has spread to document-sharing platforms, identity verification requests and media content. Any trusted workflow that ends in running a file or command deserves the same out-of-band check as a meeting invite. Nextgov/FCW
Related reading
- fake zoom meeting attack crypto
- spot north korean it workers
- binance hack explained
- web3 sdk security audit
- axios npm attack explained
Sources
- U.S. Department of Justice: Justice Department Announces Actions to Disrupt North Korea’s Massive Theft of Cryptocurrency
- FBI Internet Crime Complaint Center: North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M “FaceStealer” Crypto Theft Scheme
- Federal Bureau of Investigation: FaceStealer Cryptocurrency Theft Scheme
- Nextgov/FCW: FBI disrupts intricate North Korean fake-call scheme tied to $400M in crypto theft
- Help Net Security: Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme
- Guardian Resource Hub: Web3 SDK Security Testing: How to Audit a Wallet SDK
- Guardian Audits: Synthetix Auto-Compounding LP Vault Audit Report, M-07 Hard-coded Secrets & RPC Key
- FBI Internet Crime Complaint Center: Directing Your Complaint - Internet Crime Complaint Center (IC3)
- The Record from Recorded Future News: Feds announce seizure of $1.2 billion from Binance theft; also takedown of ‘FaceStealer’ tools
- axios project, GitHub: Post Mortem: axios npm supply chain compromise
- Cybersecurity and Infrastructure Security Agency: Supply Chain Compromise Impacts Axios Node Package Manager
- GMA News Online, Reuters: North Korean hackers steal more than $400 million using video images, FBI says
- NBC Los Angeles: FBI's LA Field Office warns of ‘FaceStealer' cryptocurrency theft scheme
Test the path from one laptop to your releases
Guardian's blockchain pentest tests whether a compromised pipeline, package registry or cloud account could ship code or reach your signing systems. Scope one around your release path.