On November 12, 2026, the Federal Bureau of Investigation (FBI) released FLASH No. AC-111226-MS, warning the cryptocurrency and web3 industry and open-source software maintainers about a North Korean social engineering scheme the FBI calls “FaceStealer” (FLASH, p. 1). The scheme relies on fake video meetings: imposter versions of platforms such as Zoom, Microsoft Teams, and Google Meet that the hackers control (FLASH, p. 1). The FBI attributes the activity to state-sponsored hackers known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima, and reports that they “have stolen more than $400 million in cryptocurrency over the past 18 months and attempted to compromise the open-source software supply chain” (FLASH, p. 1).
The same day, the Department of Justice announced in a press release that it had seized cloud-based infrastructure used in the scheme and that the FBI, under a federal warrant, had seized over 900 webcam videos of victims (DOJ Press Release). The development matters because each victim’s accounts and recorded image become the lure for the next target: invitations arrive from the real accounts of known contacts, who then appear on what looks like a live video call.
This post covers how the scheme operates, the FBI’s warnings about deepfakes and the software supply chain, the Justice Department’s actions, and the FBI’s recommendations.
How Does the North Korean FaceStealer Scheme Work?
The FLASH describes a repeating cycle in which each compromised victim supplies the accounts, contacts, and video used against the next target (FLASH, pp. 2-4). In a completed compromise, the hackers have scanned the device for “accessible cryptocurrency wallets, seed phrases, and other valuable access,” locked the victim out of Telegram or another encrypted communication application, obtained contact lists and chat histories, and “secretly recorded the victim as they waited for the start of a video chat” (FLASH, p. 2).
The hackers then message the victim’s contacts from the hijacked account to propose a Zoom or Teams meeting (FLASH, p. 3). Shortly before the scheduled time, the target receives a link to a typo-squatted domain imitating Zoom or Teams, such as uu01webzoom.us or teams.livemeet.us, which leads to a hacker-controlled copy of the meeting interface (FLASH, p. 3 & n.1).
The Justice Department’s press release describes what happens once the target joins the meeting:
North Korean hackers known publicly by the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, Advanced Persistent Threat 38 (APT38), BlueNoroff, and Stardust Chollima have lured targets with invitations to video meetings delivered from accounts stolen from prior victims. Once a target joins the meeting, the hackers record the target’s webcam video and play a prerecorded video of a previous victim or victims known to the target, thereby simulating the participation of trusted contacts in the meeting to gain the target’s trust. The North Korean hackers also use super intelligence (SI) to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries that make the FaceStealer scheme even more effective. Here again, they use the deepfake videos in the meetings with targets to gain the target’s trust.
During the meeting, the hackers then introduce a fake technical error into the meeting, such as claiming that the target cannot be heard, and provide a link or prompt to fix the error. The “fix” surreptitiously installs malware on the target’s computer. With the target’s computer compromised, the hackers can steal cryptocurrency or exploit the target’s access to other computer infrastructure. In several reported cases, the hackers stole cryptocurrency and hijacked communication accounts several months to more than a year after the initial compromise. As part of the scheme the hackers also accessed the new victim’s contact lists, social media, and communications apps to target the victim’s personal and professional contacts.
The North Korean hackers target individuals working in the cryptocurrency and web3 industries.
DOJ Press Release No. 26-1356 (Nov. 12, 2026) (unpaginated)
The FLASH adds that the malware “will eventually install a browser cookie harvester, keyloggers, screen capturers, and a backdoor onto the infected device” (FLASH, pp. 3-4), and the hackers delayed some thefts while they “waited for the balances of cryptocurrency wallets to increase” (FLASH, p. 2). The FLASH warns that “[w]ith each victim and compromised contact list, the pool of targets and victims grows exponentially” (FLASH, p. 4).
What Does the FBI Say About FaceStealer Deepfakes and Open-Source Software Targeting?
The FLASH adds two warnings: the hackers have begun generating deepfake videos, and they are using the same technique against open-source software developers and maintainers (FLASH, p. 4). The deepfakes depict well-known industry figures and are built from publicly available photos or videos (FLASH, p. 4).
The FBI notes that “[t]he quality of the deepfakes only needs to be good enough to pass as webcam video,” but that the scheme “currently continues to overwhelmingly rely on the theft of genuine victim videos” (FLASH, p. 4).
On the supply chain, the FLASH explains that infecting a software distribution could “turn a single victim (the developer or maintainer) into potentially millions of victims” (FLASH, p. 4). It recounts an incident earlier in 2026 in which the maintainer of a JavaScript library with “tens of millions of downloads per week” was infected through a fake Teams session, after which the hackers used his access “to create malicious dependencies that would be downloaded along with legitimate library downloads” (FLASH, p. 4).
The FLASH credits “quick detection and response” with defeating that attack and reports other attempts against maintainers on NPM and maintainers of Rust crates (FLASH, p. 4).
What Did the Justice Department Announce About FaceStealer and the Binance Theft?
The Justice Department announced two sets of actions on November 12, 2026: the FaceStealer infrastructure seizure and the interdiction of assets stolen from Binance (DOJ Press Release). The FaceStealer effort was led by an Assistant U.S. Attorney for the Central District of California and the FBI’s Los Angeles Field Office (DOJ Press Release).
The Binance matter is separate. The press release states that on or about October 29, North Korean military actors the FBI calls “TraderTraitor” stole more than $6 billion in virtual assets from the exchange (DOJ Press Release). More than $2.7 billion has been frozen, and the Department has obtained court authorization to seize or restrain in excess of $1.2 billion of that amount (DOJ Press Release).
For more information on how losses to digital asset theft are recovered through forfeiture, restitution, civil litigation, and tracing, see Crypto Fraud & Asset Recovery.
What Does the FBI Recommend to Protect Against FaceStealer and Respond to a Compromise?
The FBI’s recommendations focus on how a person joins a video meeting. The FLASH advises using the official application with an invite code instead of clicking a link, keeping the webcam off until the invitee can see and hear the person who sent the invitation, and not running scripts or pasting code into a terminal in response to an update prompt (FLASH, p. 5).
For digital assets, the FLASH recommends “keeping only low-dollar amounts on browser extension wallets” and keeping no recovery phrases or private keys on any device (FLASH, p. 5).
For a suspected compromise, the first listed step is to move assets to a new wallet, with new seed phrases, created on a device that was not used to communicate with the hackers (FLASH, pp. 5-6). The FLASH also directs victims to secure accounts, notify contacts and employers, and report to the Internet Crime Complaint Center using the keyword “FaceStealer” (FLASH, p. 6). The FBI has also published a FaceStealer resource page.
For more on this topic and related developments, see our resource center at digitalasset.law. If you have questions, you can request a consultation.
Frequently Asked Questions
What is the FaceStealer scheme described in the FBI’s November 12, 2026 FLASH?
FaceStealer is the FBI’s name for a North Korean social engineering scheme that uses fake Zoom, Microsoft Teams, and Google Meet sessions to trick targets into installing malware. Its distinguishing feature is the replay of secretly recorded webcam video of earlier victims, so the target believes a known contact is on the call. Each new victim’s accounts, contacts, and video are then used to reach additional targets.
Who does the FBI say is behind FaceStealer, and how much cryptocurrency has been stolen?
The FBI attributes FaceStealer to North Korean state-sponsored hackers and reports more than $400 million in cryptocurrency stolen over the past 18 months. The group is tracked publicly under several names, including Sapphire Sleet, UNC1069, APT38, and BlueNoroff. The figure is reported by the FBI, and the FLASH does not break it down by incident.
How can you tell if a Zoom or Teams invitation is a FaceStealer attack?
The FLASH does not give a single test, but it describes recurring features of the scheme. The meeting link often arrives separately, shortly before the meeting, instead of in the calendar invitation, and it points to a look-alike domain instead of the genuine service. Once the call starts, a message claims the target cannot be heard and directs the target to click an update prompt, run a script, or paste code into a terminal.
Why does the FBI’s FaceStealer warning extend to open-source software maintainers?
The FBI warns maintainers because control of a maintainer’s device and repository accounts could let the hackers distribute malicious code to everyone who downloads the software. The FLASH describes a 2026 attempt against a JavaScript library with tens of millions of weekly downloads that failed after quick detection and response. It also reports attempts against maintainers on NPM and maintainers of Rust crates.
What did the Justice Department seize in connection with FaceStealer and the Binance theft?
For FaceStealer, the Justice Department announced the seizure of cloud-based infrastructure used in the scheme, and the FBI seized over 900 victim webcam videos under a federal warrant (DOJ Press Release). Separately, the Department reported court authorization to seize or restrain more than $1.2 billion of the more than $6 billion in virtual assets stolen from Binance on or about October 29 (DOJ Press Release). The press release treats the two matters as distinct and describes the Binance recovery efforts as ongoing (DOJ Press Release).
What does the FBI say to do after a suspected FaceStealer compromise?
The FBI’s first listed step is to move cryptocurrency to a new wallet, with new seed phrases, created on a device that was not used to communicate with the hackers. The FLASH explains that North Korean hackers have copied seed phrases and waited for balances to rise before taking funds. It also advises changing passwords, logging off active sessions, adding multifactor authentication, notifying contacts and employers, and reporting to IC3.gov with the keyword FaceStealer.