The FBI and the US Justice Department said on 12 November that they had disrupted “FaceStealer”, a North Korean hacking campaign that uses fake video meetings to install malware. It has been linked to the theft of more than $400 million in cryptocurrency over the past 18 months.
The scheme starts with a meeting invitation sent from an account the hackers took over from an earlier victim, so it appears to come from someone the target knows. During the call, the attackers play recorded footage of real contacts, secretly record the target’s webcam for use in later calls and, in some cases, use AI-generated deepfake videos of well-known figures in the crypto industry. They then fake a technical problem, such as the target not being heard, and offer a “fix” that installs malware. Investigators seized the group’s cloud servers and, under a warrant, more than 900 webcam videos of victims. The FBI says the group has also targeted open-source software developers.
What to do: join calls only through the official Zoom or Teams app, check unexpected invitations through another channel, and never run a command or download a “fix” during a call. Anyone who thinks they were caught can report it to the FBI’s IC3 using the keyword FaceStealer. The Justice Department’s announcement links to the FBI’s full guidance.
Sources: US Justice Department, 12 Nov 2026; FBI FaceStealer page; The Record