The US Justice Department announced on Nov 12 the seizure of cloud infrastructure used by North Korean hackers in the "FaceStealer" social engineering scheme, which caused the theft of more than $400 million in cryptocurrency over 18 months, and the FBI seized over 900 victim webcam videos under a federal warrant [1]. According to the FBI alert, attackers use hijacked Telegram, LinkedIn, Slack and Discord accounts of prior victims to invite targets to imposter Zoom, Teams or Google Meet sessions, play prerecorded video of people the target knows, fake a technical error and get the target to click an update or run commands as a "fix" that installs malware; the FBI attributes the activity to North Korean state-sponsored hackers known publicly as Sapphire Sleet, APT38 and BlueNoroff among other names [2]. What to do now: the FBI advises joining meetings through the official video app with an invite code, confirming meetings with the inviter via another channel, and never running scripts or pasting code into a command line or terminal when prompted to update during a meeting [2].
HighActiveOfficially confirmed
FBI seizes North Korean FaceStealer fake video-meeting infrastructure: recorded footage of contacts used to trick targets into malware "fixes", over $400M in crypto stolen
2 min read
- Disclosed
- Nov 12, 2026
- Published
- Nov 14, 2026
- Last updated
- Nov 14, 2026
- CVSS basis
- Our assessment
- Technology
- Open-source package
- Attack vector
- Social engineering
- Data type
- Credentials
- Actor type
- Nation-state / APT
- Motivation
- Financial
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Finance, Technology
What to do nowOur advice
- Join video meetings with the official Zoom or Teams app and an invite code instead of clicking links to web versions, especially for invitations from infrequent or new contacts [2].
- Confirm meetings with the inviter through a different channel, such as phone or text [2].
- If prompted to update during a meeting, do not run scripts or paste code into a command line or terminal; update the app separately [2].
- Do not turn on your webcam until you can see, hear and talk with the person who invited you [2].
- Enable MFA and login alerts on Telegram, WhatsApp, Slack and other communication apps [2].
- If compromised, create a new wallet with a new seed phrase on an uninvolved device and move assets, change all passwords and log out all sessions, and report at IC3.gov with keyword "FaceStealer" [2].
Timeline
Technical details
References
Official / primary3
- [1]U.S. Department of Justice2026-11-12Accessed 2026-11-14Snapshot 2026-11-14 sha256 681e395da673
“These actions include the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme that has resulted in the theft of more than $400 million worth of cryptocurrency”
- [2]FBI / IC32026-11-12Accessed 2026-11-14Snapshot 2026-11-14 sha256 f12a76dc2460
“The FBI attributes this activity to North Korean state-sponsored hackers, known publicly by the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.”
- [3]FBI2026-11-12Accessed 2026-11-14Snapshot 2026-11-14 sha256 23499eb3ab0c
“The FBI identified and seized over 900 webcam videos of victims working in the crypto and Web3 industries around the world.”
Research1
- [4]Arctic Wolf2026-11-12Accessed 2026-11-14Snapshot 2026-11-14 sha256 46b814f90a2d
“Founders and C-suite executives make up 84% of that total. These counts describe who the threat actor prepared material against, not confirmed compromises.”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.