Research

FBI: North Korea Stole $400 Million With Fake Video Calls. Most Faces Were Real, Recorded From Earlier Victims.

Patrick Duggan · · 7 min read

FBI: North Korea Stole $400 Million With Fake Video Calls. Most Faces Were Real, Recorded From Earlier Victims.

If someone you know sends a Zoom or Teams link in Telegram, LinkedIn, Slack or Discord, do not click it. Confirm the meeting with that person on a phone number or channel you already had, open the official Zoom or Teams app yourself and join with the meeting ID, and if anyone in the call tells you your audio is broken and asks you to click an update, run a script or paste a command into Terminal, leave the call. That last request is the attack. On November 12, the FBI published a FLASH alert saying North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months with exactly this play, which the FBI calls FaceStealer.

The headlines say deepfakes. The FBI says something more uncomfortable: the faces on these calls are mostly real. The hackers secretly record each victim's webcam while they wait for a call to start, then play that recording to the victim's own contacts. The FBI says it has identified and seized more than 900 of those victim videos. Deepfakes of well-known people are a newer add-on; the FBI says the scheme "currently continues to overwhelmingly rely on the theft of genuine victim videos."

A diagram of the six FaceStealer stages from the FBI FLASH, each with the step that breaks it. Stage 1, an earlier victim's wallets, chat account and contacts are taken and their webcam is secretly recorded. Stage 2, the hijacked account invites contacts to a Zoom or Teams call to catch up or discuss an investment. Stage 3, a Calendly invite, then a late meeting link on a typo-squatted domain such as uu01webzoom.us or teams.livemeet.us. Stage 4, the earlier victim's recorded video plays so the call looks real, with deepfakes as an emerging add-on. Stage 5, the target is told their audio is broken and to click an update, run a script or paste code into Terminal, which installs a cookie harvester, keylogger, screen capturer and backdoor. Stage 6, the target becomes the next victim, crypto is stolen sometimes months later, and maintainer accounts are abused. A band below gives the treasury rule: small amounts in browser wallets, larger balances on an offline hardware wallet, and a second signer for large transfers.

What to do

  1. Verify every video-call invite out of band. Call or text the person on a number you already had before this conversation. The FBI's example: "if you receive a Telegram message, confirm the meeting by text or phone." A message from their real account proves nothing; in this scheme the account is the hacker's.
  2. Never join from a link in chat. Open the Zoom, Teams or Google Meet app you installed from the vendor and type the meeting ID. The FBI says the hackers often leave the meeting link out of the Calendly invite and send it shortly before the call, from the hijacked account, so a link that shows up late is a warning sign in itself.
  3. Refuse the "your audio is broken, run this" request. No real meeting needs you to paste a command into Terminal, run a script, or install a "fixed" client, SDK or plugin that someone sent you in chat or in the meeting. The FBI: "do not run scripts or copy code into the command line or terminal to update the client." If an update is real, get it from the vendor's own site or app store after the call.
  4. Camera off until you have talked to the inviter live. The FBI recommends not turning on your webcam until you can see, hear and talk to the person who invited you. That denies them the next video. Ask them something only they would know; a looped recording cannot answer.
  5. Lock down the chat apps that carry the invites. Multifactor authentication, login alerts and expiring messages on Telegram, WhatsApp, Slack and the rest, per the FBI. The FBI says the hijack works by logging in from another device, changing the recovery phone number and closing your sessions, so a login alert is your early warning.
  6. Treasury rules. Keep only small amounts in browser-extension wallets. Keep larger balances on a hardware wallet that is not connected to your everyday computer, or with an exchange, as the FBI advises. Keep no seed phrases or private keys anywhere on any device: the FBI says these hackers copy recovery phrases, watch the balance on-chain and drain the wallet after a large transfer arrives, months or more than a year later. For a company or fund, add our rule: any transfer above a threshold needs a second signer on a separate device (a multisig wallet or a custody policy), so one infected laptop cannot move the treasury.
  7. Maintainers: assume you are on the list. The FBI says the same play was used against "a significant open-source JavaScript library" receiving "tens of millions of downloads per week," and against maintainers on npm and, recently, Rust crates. Hardware security keys on your registry and GitHub accounts, and publishing from CI with trusted publishing rather than from your laptop, limit what a compromised workstation can push.

If you think you joined one of these calls: follow the FBI's list. From a different, clean device, create a new wallet with a new seed phrase and move your funds to it. Change passwords and log out every session on your chat and developer accounts. Tell your contacts, and your employer if work data was on the device, that your accounts may be used to impersonate you. Report at ic3.gov with the keyword FaceStealer.

What the FBI confirmed

All of this is from FBI FLASH AC-111226-MS, dated November 12, 2026, marked TLP:CLEAR.

  • The money and the period. "Using the FaceStealer scheme, the actors have stolen more than $400 million in cryptocurrency over the past 18 months." The count is cryptocurrency stolen through this one scheme. The FLASH does not say how many victims make up that figure or how it was tallied.
  • Who is targeted. The FLASH is addressed to the "cryptocurrency/web3 industry and open-source software maintainers." The FBI says the hackers mainly go after people and companies they can steal cryptocurrency from, and have also targeted software developers and maintainers to reach the supply chain.
  • Who did it. "The FBI attributes this activity to North Korean state-sponsored hackers, known publicly by the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima."
  • The 900 videos. The FBI says it "has identified and seized over 900 victim webcam videos the hackers have used to convincingly impersonate victims in follow-on attacks." That is a count of recordings seized, not a count of people robbed.
  • How it works. Six stages: a compromised earlier victim; their hijacked chat account inviting contacts to "catch up," "discuss collaboration," or "talk about investment opportunities"; a Calendly or similar invite, then a late link to a typo-squatted domain hosting a copycat Zoom or Teams; the earlier victim's recorded video, often with more videos to fake a full room; a direct message claiming an audio problem, with instructions to click an "update," run a script or paste code; and malware that installs "a browser cookie harvester, keyloggers, screen capturers, and a backdoor." The hackers also start recording the new victim's webcam when they click the fake link. The FBI also names hijacked and newly created LinkedIn, Slack and Discord accounts as first contact.
  • Patience. "In several reported cases, the hackers stole cryptocurrency and hijacked communication accounts, months to over a year after the initial compromise as the hackers waited for the balances of cryptocurrency wallets to increase."
  • Deepfakes. The FBI says the hackers "have begun to use super intelligence (SI)" to make deepfakes, focused on "well-known and influential individuals in the cryptocurrency and web3 industries," built from public photos and video. The FBI says the quality "only needs to be good enough to pass as webcam video."
  • The near miss. The FBI describes a maintainer of a JavaScript library with "tens of millions of downloads per week" who was lured into a fake Teams call with at least one person he recognized, ran the "corrective" steps and was infected; the hackers then used his access to add malicious dependencies, and the FBI credits quick detection with stopping it. The FBI does not name the library. The Hacker News links this to the Axios npm compromise it reported in the spring; that link is the press's, not the FLASH's.

What is not known

  • How the $400 million breaks down. No victim count, no list of thefts, no split between individuals and companies in the FLASH.
  • Whether the $400 million overlaps other North Korea totals. The Hacker News also reports a Justice Department seizure and restraint of more than $1.2 billion stolen by what it calls TraderTraitor actors after the Binance hack. That is a separate case and a separate figure; we did not read the Justice Department release, and the FLASH does not connect the two.
  • The malware. The FLASH describes what the malware does but names no family and publishes no hashes.
  • The full infrastructure. The FBI gives two domains as "examples" of "many" typo-squatted domains. For full indicator lists it points to reports by Arctic Wolf, JUMPSEC and Microsoft Threat Intelligence, which we did not read for this post.

How we checked, and what we cannot see

  • Indicators the FBI published: two domains, uu01webzoom.us and teams.livemeet.us, given as examples of North Korean-controlled typo-squatted meeting domains. No wallet addresses, IP addresses or hashes in the FLASH.
  • What our index already held. uu01webzoom.us has been in our index since January 26, 2026, from a third-party feed (TweetFeed, crediting a post by Validin) at confidence 70, with no actor attached. That is the feed's catch and Validin's, carried by us, not our own detection, and it is not a lead on the FBI. teams.livemeet.us was not in our index when we checked. We have not added either domain or attributed the existing record yet; that decision is pending.
  • No edge check. These lures arrive in chat apps and calendar invites and run on the victim's machine. Our edge shield and honeypots see web traffic to our own properties, so they would not see this, and we make no claim either way.
  • Our earlier coverage. We wrote about the same family of tricks from other angles: the fake coding test ("Fake Coding Test Malware: How to Scan a Recruiter's Repo Before You Open It," www.dugganusa.com/post/fake-coding-test-malware-scan-recruiter-repo-before-opening), North Korea's September exchange and developer thefts (www.dugganusa.com/post/north-korea-robbed-an-exchange-and-thirty-thousand-developers-in-the-same-week-the-exchange-got-the), the Binance theft that began with an engineer's laptop (www.dugganusa.com/post/binance-lost-6-4-billion-in-one-afternoon-its-first-explanation-is-an-engineer-s-laptop-and-no-pe), and attackers spending trust they did not earn (www.dugganusa.com/post/borrowed-credit-trust-attackers-did-not-earn-boring-fixes). This post is the first we have written on FaceStealer itself.

Sources

  • FBI FLASH AC-111226-MS, "North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M 'FaceStealer' Crypto Theft Scheme," November 12, 2026 (the primary, TLP:CLEAR): www.ic3.gov/CSA/2026/261112.pdf
  • The Hacker News, "FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls," November 13, 2026 (the lead): thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html
  • The Hacker News, "Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft," November 3, 2026 (related): thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html
  • Reports the FBI cites for full indicator lists, not read for this post: Arctic Wolf, "Still in the Meeting: BlueNoroff Six Months On"; JUMPSEC, "Inside a DPRK BlueNoroff ClickFix Kit"; Microsoft, "Dissecting Sapphire Sleet's macOS intrusion from lure to compromise," April 16, 2026.

Limits

We read the FLASH as a PDF converted to text. The FBI's web page for FaceStealer on fbi.gov returned HTTP 403 to us, so we did not read it, and we did not read the Justice Department release. Quotes above are the FLASH's exact words; everything else in the "confirmed" section is our paraphrase of it. The multisig rule in step 6, the out-of-band question in step 4 and the maintainer advice in step 7 are ours, not the FBI's.

Five percent of this is wrong somewhere. It always is.

Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register