The Federal Bureau of Investigation issued a public security alert on November 12, 2026 warning that a sophisticated North Korean hacking operation has stolen over $400 million in cryptocurrency by exploiting webcam video calls. The campaign, tracked as “FaceStealer,” has compromised more than 900 technology workers across the United States over the past 18 months.
How the scheme works
Hackers first hijack legitimate accounts on platforms such as Telegram, LinkedIn, Slack and Discord. Using the stolen credentials, they contact the victim’s colleagues and friends, arranging video calls under familiar pretexts – a casual “catch‑up,” a discussion of a potential collaboration, or an alleged investment opportunity. Because the attackers have access to prior chat histories, the invitations appear authentic.
When a target accepts, the criminals send a calendar invite through services like Calendly and then provide a link that looks like a standard Zoom, Microsoft Teams, or Google Meet room. The URLs are subtly misspelled (e.g., “uu01webzoom.us” or “teams.livemeet.us”) and hosted on North Korean servers. Once the victim clicks the link, the fake lobby begins recording the target’s own webcam.
Deception with prerecorded footage
To make the call seem legitimate, the hackers play prerecorded webcam loops of previous victims, sometimes inserting multiple fake participants. The victim sees what appears to be a normal group meeting and is told, via a trusted contact’s chat, that an audio glitch is preventing them from being heard. Under pressure, the victim is instructed to click an “update” prompt, run a script, or paste code into a terminal to “fix” the audio.
Executing those instructions installs malware that logs keystrokes, captures screenshots, harvests browser cookies and creates a permanent backdoor. The FBI confirmed it has seized over 900 of the stolen videos that keep the compromise chain active.
Financial impact and broader threats
In documented cases, attackers sometimes wait months – even over a year – after infection before draining cryptocurrency wallets, monitoring blockchain activity until balances grow large enough to justify a large‑scale theft. Beyond personal wallets, the group has targeted open‑source software maintainers, attempting to poison widely used code. A recent incident involved a major JavaScript library maintainer who was lured into a fake Teams call, leading the hackers to plant malicious code into a library downloaded millions of times weekly. Security teams intercepted the breach before it could spread further.
The FBI also warned that the group is experimenting with AI‑generated deepfake videos of prominent figures in the cryptocurrency and Web3 sectors, inserting these synthetic clips into fake calls to increase credibility.
FBI recommendations for tech workers
The bureau urges professionals to join meetings directly through official applications using a meeting ID rather than clicking links, and to keep webcams turned off until the other party speaks. Users should never run terminal commands or scripts to fix video‑chat glitches and should verify meeting requests through a second method such as a phone call or text.
For cryptocurrency holdings, the FBI advises storing large amounts on offline hardware wallets rather than browser extensions, moving suspected compromised funds to a clean wallet, notifying contacts and employers, and filing a report with the Internet Crime Complaint Center (IC3.gov) using the keyword “FaceStealer.”
Original reporting: Tampa Free Press — read the source article.
