The FBI is warning cryptocurrency and Web3 workers, and open-source software maintainers, about FaceStealer, a North Korean social engineering scheme used to steal more than $400 million in cryptocurrency over the past 18 months and to target the software supply chain.
On November 12, 2026, the FBI and the U.S. Department of Justice announced that they had disrupted cloud-based infrastructure used in the scheme and seized over 900 secretly recorded webcam videos of victims. The investigation was led by the FBI’s Los Angeles Field Office and prosecutors in the Central District of California. The bureau published a FLASH advisory (AC-111226-MS) the same day and a resource page at fbi.gov/facestealer.
Who the FBI says is behind FaceStealer
The FBI attributes the activity to North Korean state-sponsored hackers, known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. In the Justice Department announcement, FBI Los Angeles Assistant Director in Charge Patrick Grandy called it “a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user.”
How the scheme works
According to the FBI, FaceStealer relies on imposter versions of Zoom, Microsoft Teams and Google Meet that the hackers control. Targets are invited from genuine accounts hijacked from earlier victims, including accounts on Telegram, LinkedIn, Slack and Discord.
The cycle starts with a device the hackers already control. They record the first victim’s webcam, take over a messaging account, and write to that person’s contacts proposing a meeting. When a contact agrees, the hackers often send a calendar invite, then, shortly before the meeting, deliver a typo-squatted link that looks like a legitimate Zoom or Teams URL. Two examples the FBI published are uu01webzoom.us and teams.livemeet.us.
Once the new target joins, the hackers play the earlier victim’s recorded webcam video, and often additional recordings, so it appears that people the target knows are on the call. They also start recording the new target’s camera. Someone posing as the trusted contact then claims there is an audio problem and offers a “fix,” such as an update prompt or code to paste into a terminal. The FBI says that step installs malware that can steal browser cookies, capture activity on the device and leave a backdoor.
With the device compromised, the hackers can steal cryptocurrency that is reachable from it, or use the victim’s access to an employer’s network or an open-source maintainer account. They also take contact lists so they can repeat the cycle. In several cases the FBI reviewed, the actors stole cryptocurrency months to more than a year after the first intrusion, waiting for wallet balances to grow.
Recorded videos and deepfakes
The more than 900 seized videos were used, the FBI says, to impersonate victims in later attacks. The same actors have also begun generating deepfake videos of well-known people in the cryptocurrency and Web3 industries from publicly available photos or footage, a tactic the FBI calls “super intelligence (SI).” The bureau says the scheme still overwhelmingly relies on genuine stolen victim video.
Attempts against the open-source supply chain
Stealing cryptocurrency has been the main aim, but the FBI says the same technique is now also used against open-source maintainers. The FLASH describes one case earlier this year in which the actors lured a maintainer of a widely used open-source JavaScript library into a fake Microsoft Teams session that appeared to include at least one person the maintainer recognized. The maintainer followed the supposed fix, and the hackers used that access to create malicious dependencies that would have shipped with the legitimate library. The FBI said the library receives tens of millions of downloads per week, and that the attempt was detected and stopped before it spread widely. The bureau did not name the library. It also said it is aware of other attempts against high-volume projects, including packages on npm and, more recently, maintainers of Rust crates.
North Korean hackers have used social engineering against crypto workers in other, separate cases, including a 2026 incident at Zerion, which the FBI’s FaceStealer materials do not tie to this scheme.
What the FBI recommends
The FLASH tells potential targets to join meetings through the official Zoom or Teams app and an invite code, rather than by clicking a link. It also advises people not to turn on a webcam until they can see and talk to the person who invited them, and not to paste code into a terminal to “update” a meeting client. Other guidance includes confirming a call over a second channel and turning on multifactor authentication on messaging apps. The FBI recommends keeping only small amounts of cryptocurrency in browser extension wallets, storing larger balances on a hardware wallet or at an exchange, and never leaving seed phrases on a device. Anyone who thinks they have been compromised should move funds to a new wallet created on a different device, warn contacts that someone may be impersonating them with recorded video, and file a report at IC3.gov with the keyword FaceStealer.
A separate North Korea case in the same announcement
The same Justice Department release also described, as a separate matter, court-authorized seizures and restraints of more than $1.2 billion in cryptocurrency taken in the October 29 theft from Binance. The FBI attributes that theft to North Korean military hackers it calls TraderTraitor. BreachNews previously covered the Binance theft.
