FaceStealer: FBI warns of fake Zoom calls that drain crypto wallets

An invitation to a video call from someone you know can be the start of a theft. The FBI is warning of a scheme it calls FaceStealer: North Korean hackers use hijacked accounts to invite people to fake Zoom and Teams sessions, play recorded videos of real acquaintances there and get the target to install malware themselves. According to the US Justice Department, the attackers have used it to steal more than $400 million in cryptocurrency over the past 18 months.

On November 12, 2026, the department seized the campaign's cloud infrastructure. In the same announcement it said courts had authorised the seizure or restraint of more than $1.2 billion from the Binance hack of October 29. Both are set out in the US Justice Department press release of November 12. The most important defence is simple: only start video conferences through the official app with a meeting code, and never run a script that someone sends you during a call.

FaceStealer: how the fake Zoom call scam works

FaceStealer is the name the FBI has given to a social engineering campaign. Social engineering means the attackers do not exploit a technical flaw but persuade people to open the door for them. According to the FBI, the campaign is run by groups known under names such as Sapphire Sleet, UNC1069, BlueNoroff, APT38 or Stardust Chollima. All of them are attributed to the North Korean state.

The principle is a cycle. Every new victim gives the attackers three things: access to their computer, access to their chat accounts and a secretly recorded webcam video. With the account and the video, the attackers then approach the victim's contacts. The FBI says it has seized more than 900 such webcam recordings under a search warrant. Each one stands for a person whose face has already served as bait for the next attack.

Hijacked Telegram accounts open the door for the invitation

The first contact does not come from strangers. The attackers write from the real accounts of earlier victims; the FBI names Telegram, LinkedIn, Slack and Discord. Because they can read the chat history, they tailor their messages to earlier conversations. The pretexts sound harmless: catching up, discussing a collaboration, talking through an investment opportunity.

Once the target agrees, a meeting request follows via Calendly or a similar scheduling service. The FBI notes that this invitation often does not yet contain a link to the video conference. The attackers send it only shortly before the meeting, through the hijacked chat account. That keeps their infrastructure visible for as short a time as possible, and by then the target has already received at least two messages from a familiar account.

Typosquatting: fake Zoom and Teams pages with a lobby look

The link does not lead to Zoom or Microsoft Teams but to a page run by the attackers. The FBI calls this typosquatting: the attackers register addresses that look almost identical to real services, for example through swapped letters, extra words or hyphens. The bureau cites uu01webzoom.us and teams.livemeet.us as examples. The cloned interface is meant to be indistinguishable from the original, including a waiting room in which you appear to be waiting to be let in.

As soon as you click the link, your webcam is already recording. In the meeting you then see the video of the acquaintance who invited you, often alongside other participants. In reality these are recordings of earlier victims being played back. Anyone who switches on their camera supplies the material for the next round.

The fake audio fault as a malware trap

After a short while, the supposed acquaintance posts a chat message in the meeting: they cannot hear you. The other participants add to the pressure, because you seem to be the only one with the problem. Then comes the supposed fix. You are asked to click on an update prompt, run a script or paste a command into the terminal.

That very step installs the malware. According to the FBI, it loads, among other things, a program that harvests browser cookies, a keylogger that records keystrokes, a screen-capture tool and a backdoor for persistent access. Security researchers call this technique ClickFix: the victim runs the malicious command themselves, which is why many security programs do not raise an alarm. The security firm Arctic Wolf has published a technical analysis of such attacks in a separate report.

Deepfake videos of well-known crypto figures as a new stage

What is new in the warning is the use of deepfakes. A deepfake is a video generated with artificial intelligence that shows a real person who never actually stood in front of the camera like that. According to the FBI, the attackers now create such videos from publicly available photos and clips of well-known people in the crypto and Web3 industry. The quality only has to be good enough for a webcam image.

A fake face of a prominent figure in the call is meant to build even more trust. The FBI stresses, however, that the campaign still mostly relies on stolen videos of real victims. For you, that means a familiar face on screen is no longer proof that the person is really on the other end.

Seed phrase on the computer: why the attackers wait for months

One detail in the warning is particularly sensitive. After a successful infection, the malware searches the computer for crypto wallets, seed phrases and other credentials. The seed phrase is the sequence of words that can fully restore a wallet. Whoever has it owns the coins.

The attackers do not strike straight away. In several cases, according to the FBI, the theft came months or even more than a year after the original infection. The attackers copy the recovery words, watch the balances on the blockchain and only empty the wallet once a larger deposit makes it worthwhile. A computer that was compromised months ago is therefore still a danger today, even if nothing has gone missing so far.

Binance hack: $1.2 billion seized, $2.7 billion frozen

The second part of the announcement concerns the Binance hack. On or around October 29, members of the North Korean military, whom the FBI calls TraderTraitor, stole virtual assets worth more than $6 billion from Binance, according to the Justice Department. How the attack unfolded and who is behind it is summarised in our report on the Binance hack and TraderTraitor.

Since then, authorities and companies have jointly frozen more than $2.7 billion. For more than $1.2 billion of that, a court has already authorised seizure or restraint. The search continues, because according to the department the attackers are moving the loot through bridges, mixers and exchanges. A bridge is a service that transfers tokens between two blockchains; a mixer blends the payments of many users to disguise their origin. Assistant Attorney General A. Tysen Duva said about half of the historic theft had been stopped immediately.

For exchange customers, the case shows how important supervision and clear custody rules are. A licence under the European MiCA regulation obliges providers in the EU, among other things, to hold client assets separately.

Open-source supply chain: npm and Rust packages in the crosshairs

FaceStealer does not only target crypto holdings. According to the FBI, the attackers are increasingly approaching people who develop and maintain open-source software. If they gain access to those people's computers, they can slip malicious code into software packages that millions of users then download. Experts call this a supply chain attack.

Earlier this year, according to the FBI, such an attack almost succeeded. The maintainer of a major JavaScript library with tens of millions of downloads a week followed the supposed fix during a fake Teams call. The attackers used his access to inject malicious dependencies into the library. Only quick detection prevented major damage. Further attempts targeted maintainers of packages in the npm JavaScript registry and, most recently, Rust packages, known as crates. Wallet software is also built on such packages.

Patrick Grandy, head of the FBI's Los Angeles field office, describes the scheme as highly effective, even against technically savvy and security-conscious users. FaceStealer exploits trust in ubiquitous video conferencing and in personal relationships, he said. Anyone who cannot imagine a scenario in which they would fall for it is not thinking creatively enough, Grandy said according to the press release.

How to protect yourself from fake video calls and ClickFix malware

What happened: On November 12, 2026, the US Justice Department and the FBI seized the infrastructure of North Korea's FaceStealer campaign. The attackers lure people through hijacked chat accounts into cloned Zoom and Teams sessions and use a fake audio fault to get their targets to install malware. According to the department, the damage exceeds $400 million over 18 months.

Are you affected? According to the FBI, the focus is on people in the crypto and Web3 industry and on developers of open-source software. Because the attackers work through their victims' contact lists, however, anyone connected to these people can be approached. A warning sign is a video call that you join via a link instead of through the app and during which you are asked to run an update, script or command. If you have done that in recent months, treat the computer as infected.

1. Meeting code, not a link: Only join Zoom or Teams sessions through the installed app with the meeting code, especially when the invitation comes from contacts you rarely speak to.
2. Camera on later: Only switch on your webcam once you can see and hear the person who invited you live and have asked them a question only they can answer.
3. No commands during a call: Never run a script or paste code into the terminal during a meeting; if needed, update the app separately via the vendor's website.
4. Second channel: Confirm every meeting through a different route from the one the invitation came through, for example with a phone call if the request arrived via Telegram.
5. Secure chat accounts: Turn on two-factor login and login notifications in Telegram, WhatsApp and Slack, and use disappearing messages so that hijacked chat histories reveal little.

The basics of safe storage are explained in our guide on how to store crypto safely, and suitable devices are compared in the hardware wallet comparison.

Infected computer: the emergency steps recommended by the FBI

Anyone who suspects they have fallen into such a trap should secure their coins first. The FBI recommends creating a new wallet with a new seed phrase on a device that has never been used to communicate with the attackers, and transferring all holdings there. The old recovery phrase should be considered burned, because the attackers may have copied it and could simply be waiting for the right moment.

Then come the accounts. Change all passwords, log out of all active sessions in Telegram, WhatsApp and other services, and set up two-factor login. If you have already lost access to an account, contact the platform and have it locked or restored. Also tell your contacts that someone could be writing in your name and playing your webcam video. If the call took place on a work computer, or if work files are stored on your personal device, your employer needs to know too.

In the US, the FBI accepts reports via its IC3 platform with the keyword FaceStealer. In Germany, the police are the first point of contact, and most federal states offer an online police station for this.

Software wallet or hardware wallet: where the FBI wants larger amounts held

A software wallet is a program or browser extension that stores your keys on your computer or smartphone. That is exactly where FaceStealer strikes. The FBI therefore advises keeping only small amounts in browser extensions. Larger holdings should go on a separate physical device that is not connected to the computer, or to an exchange. According to the FBI, recovery phrases and private keys belong on no device at all.

A hardware wallet signs transactions on its own device, and the private key never leaves it. A keylogger on your laptop therefore cannot capture it. The condition is that you never type in your seed phrase, never photograph it and never store it in a cloud. For everyday use with small amounts, a software wallet remains practical, as long as it holds no more than you could afford to lose.

FaceStealer defence: three habits against the $400 million scam

1. Split your holdings: Keep only what you need for your next transactions in the browser wallet, and move the rest to a device from the hardware wallet comparison.
2. Choose a supervised exchange: If you leave coins on a platform, pick one with a MiCA licence from our overview of regulated crypto exchanges.
3. Choose your everyday wallet with care: For small amounts on your smartphone, the software wallet comparison helps you pick an app with transaction warnings.

(As of November 13, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)