FBI FaceStealer Scam: Fake Zoom Calls Stole $400M

Imagine your homie DMs you on Telegram, you hop on a Zoom, you literally see their face… and it's not them. That's the whole game behind FaceStealer, a scam the FBI just exposed that's pulled in more than $400 million in crypto. No deepfake wizardry needed (mostly), just stolen webcam clips and one fake "audio fix" button. Here's how it works and how not to be the next face on the loop.

TL;DR

On 12 November 2026 the FBI put out a FLASH alert on FaceStealer, a North Korean scheme using fake Zoom, Teams and Google Meet calls.

Hackers have stolen more than $400 million in crypto over 18 months, and the FBI has seized 900+ secretly recorded victim webcam videos.

The invite comes from a real, hijacked account of someone you know, and the call plays their pre-recorded video.

The trap: a fake "they can't hear you" error that tells you to run an update, a script or a terminal command. That "fix" is malware.

Rule of thumb: join only via the official app with a meeting code, keep your camera off until you've actually talked to the person, and never paste commands to fix a meeting.

What is the FaceStealer scam?

FaceStealer is the name the FBI gave to a social engineering scheme it pins on North Korean state hackers, known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. The bureau laid it all out in its 12 November 2026 FLASH alert and on its FaceStealer page.

The FBI calls it "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user". Patrick Grandy, who runs the FBI's Los Angeles field office, put it even more bluntly to the BBC: "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."

How the fake Zoom call scam works, step by step

Someone you know gets hacked first. The hackers take over their Telegram (or LinkedIn, Slack or Discord), read their chat history and grab their contact list. They've also secretly recorded that person's webcam.
You get a friendly DM. From that real account, they suggest a call to "catch up", "discuss collaboration" or "talk about investment opportunities". Because they've read old chats, the message can sound exactly like your friend.
A legit-looking calendar invite. They often send a Calendly invite to set the time. The actual meeting link only shows up shortly before the call.
The link is a lookalike. It points to a typosquatted domain dressed up as Zoom or Teams. The FBI lists examples like uu01webzoom.us and teams.livemeet.us. The page is a copycat built to look identical to the real thing.
You see familiar faces. Once you're "admitted", they play your friend's recorded webcam clip, often next to clips of other "participants" to make it feel like a real group call.
The "audio problem". A chat message says nobody can hear you and walks you through clicking an update, running a script or pasting code into your terminal.
Game over. That fix installs a browser cookie harvester, keyloggers, a screen capturer and a backdoor. And your webcam has been recording since you clicked the link, so you become the familiar face for their next target.

FBI redacted and blurred grid of victim webcam videos secretly recorded by North Korean FaceStealer hackers

The FBI's redacted and blurred examples of the 900+ victim videos it says the hackers recorded.

Why this one hits different

Most scams fall apart the second you see a real face. FaceStealer flips that: seeing a face you trust is the bait. And the hackers are patient. The FBI says that in several cases they waited months to over a year after the initial infection, watching wallet balances grow before draining them.

It's also spreading beyond crypto bros. Per the FBI, earlier this year the hackers pulled the maintainer of a major open-source JavaScript library (one with tens of millions of weekly downloads) into a fake Teams call with at least one person he recognised. He ran the "fix", and the attackers used his access to push malicious dependencies. It was caught quickly, but the FBI says it has seen more attempts against npm maintainers and, more recently, Rust crate maintainers. Help Net Security and Nextgov/FCW have more detail on the fallout.

Are deepfakes involved?

Sometimes. The FBI says the group has started making deepfake videos of well-known crypto and web3 figures from public photos and video, and that "the quality of the deepfakes only needs to be good enough to pass as webcam video." But it stresses that the scheme still "overwhelmingly" relies on real stolen webcam footage. So "I'll spot the AI glitches" is not a safety plan.

How to spot a fake Zoom or Teams meeting

The link shows up late. The calendar invite has no meeting link, and one appears right before the call. The FBI flags this as a classic FaceStealer move.
The domain is a little off. Extra characters, weird subdomains, or a .us or random domain instead of zoom.us or teams.microsoft.com.
You're asked to run something. Real Zoom and Teams never need you to paste a terminal command or run a script to fix your mic.
Everyone's on video but nobody actually talks to you. Recorded clips can't answer a direct question.
The pressure is on. Multiple "participants" waiting on you is designed to make you rush the fix.

How to protect yourself (straight from the FBI)

Join through the official Zoom or Teams app with a meeting code, not a link to a web version, especially for invites from new or rare contacts.
Keep your webcam off until you can see, hear and talk to the person who invited you.
Never run scripts or paste code to "update" a meeting app. Close it and update the app separately.
Confirm the meeting on a different channel. Got the invite on Telegram? Text or call the person first.
Lock down your chat apps. Turn on multifactor authentication, login alerts and expiring messages on Telegram, WhatsApp and Slack. Even better, use phishing-resistant sign-ins like passkeys where you can.
Keep crypto off your daily device. Only small amounts in browser-extension wallets, bigger balances on a separate hardware wallet or exchange, and never store seed phrases or private keys on your devices.

Think you got hit? Do this now

Create a new crypto wallet with a new seed phrase on a clean device and move your funds into it.
Change all your passwords, log out every active session, and add MFA on Telegram, WhatsApp, developer accounts and anything sensitive.
Warn your contacts that someone may be impersonating you with recorded video, and tell your employer if work files or devices were involved.
If you're locked out of an account, ask the platform to shut it down or restore it.
Report it at IC3.gov with the keyword "FaceStealer".

Keep your scam radar sharp

FAQ

What is the FaceStealer scam?

FaceStealer is the FBI's name for a North Korean social engineering scheme that lures people into fake Zoom, Microsoft Teams or Google Meet calls, plays secretly recorded webcam video of someone they know, then tricks them into running an "audio fix" that installs malware.

How much money has FaceStealer stolen?

According to the FBI's 12 November 2026 FLASH alert, the hackers stole more than $400 million in cryptocurrency over the past 18 months. The FBI says it has seized more than 900 victim webcam videos used in the scheme.

Who is behind FaceStealer?

The FBI attributes it to North Korean state-sponsored hackers publicly known as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.

Who is being targeted?

Mainly people working in crypto and web3 and open-source software maintainers, including maintainers on npm and Rust crates. The invites arrive from hijacked Telegram, LinkedIn, Slack and Discord accounts of people the target already knows.

How can I tell if a Zoom or Teams call is fake?

Be suspicious if the meeting link arrives only shortly before the call, the domain looks slightly off (the FBI lists examples like uu01webzoom.us and teams.livemeet.us), or you're asked to run a script, paste a command or install an update to fix audio. Join only through the official app with a meeting code.

What should I do if I think I've been hit?

The FBI says to move crypto to a new wallet with a new seed phrase created on a clean device, change all passwords, log out all sessions and add MFA on chat and developer accounts, warn your contacts and employer, and report it at IC3.gov with the keyword "FaceStealer".

Main source: FBI FLASH alert AC-111226-MS, "North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M FaceStealer Crypto Theft Scheme" (12 November 2026). Also referenced: FBI, FaceStealer Cryptocurrency Theft Scheme, BBC News (13 November 2026), Help Net Security (13 November 2026) and Nextgov/FCW.