> ## Content Index > Fetch the complete content index at: https://cms.thedarkwebnews.com/llms.txt > Use this file to discover other available public pages before exploring further. # FBI Exposes North Korean “FaceStealer” Scheme: $400M in Crypto Stolen Using Secretly Recorded Webcam Videos of 900+ Victims - URL: https://cms.thedarkwebnews.com/fbi-exposes-north-korean-facestealer-scheme-400m-in-crypto-stolen-using-secretly-recorded-webcam-videos-of-900-victims/ - Published: 2026-11-12T22:50:00.000Z - Updated: 2026-11-12T22:50:00.000Z - Author: Darkintel Team - Tags: Threat Intelligence On November 12, 2026, the FBI released a TLP:CLEAR FLASH alert (AC-111226-MS) warning the cryptocurrency/web3 industry and open-source software maintainers about a highly effective North Korean social engineering campaign it calls **“FaceStealer.”** According to the FBI, the scheme has stolen more than **$400 million in cryptocurrency over the past 18 months** and has tried to compromise the open-source software supply chain. **Attribution** The FBI attributes the activity to North Korean state-sponsored hackers publicly known as **Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima**. **How FaceStealer works** The campaign relies on fake versions of popular video meeting platforms, such as Zoom, Microsoft Teams, and Google Meet, that the hackers control. What makes it so convincing is the use of real, secretly recorded webcam footage of previous victims. The FBI describes a self-spreading cycle in five stages: 1. **Compromise the device and secretly record the webcam:** On an already compromised machine, the hackers scan for cryptocurrency wallets, seed phrases, and other valuable access. They take over and lock the victim out of their Telegram account or other encrypted messaging apps, collect the victim’s contact lists and chat histories, and secretly record the victim’s webcam while they wait for a video call to start. 2. **Hijack messaging accounts:** Using the victim’s real Telegram, WhatsApp, LinkedIn, Slack, or Discord accounts, the attackers message the victim’s contacts. 3. **Send a convincing fake meeting link:** Contacts receive what looks like a genuine invitation to a Zoom or Teams meeting, sent from an account they trust. 4. **Lure contacts into a realistic fake call:** When the target joins, the hackers play the prerecorded webcam video of the trusted contact to simulate a real call. They also record the new target’s webcam. 5. **Fake a technical problem to infect the target:** The hackers show a mock technical error in the meeting and, posing as the trusted contact, give instructions to fix it. The “fix” installs malware on the target’s computer, turning them into the next victim. **What happens after compromise** Once a computer is compromised, the attackers can steal accessible cryptocurrency or abuse the victim’s access to outside infrastructure, such as an employer’s network or an open-source maintainer’s account. In several reported cases, the hackers stole cryptocurrency and hijacked accounts **months to more than a year after the initial compromise**, waiting for wallet balances to grow. They also took the victims’ contact lists, social media and messaging apps, and webcam footage to target their personal and professional contacts. 0:00 /2:10 1× **900+ victim videos seized** The FBI has found and seized more than 900 victim webcam videos that the hackers used to impersonate victims in follow-on attacks. The FLASH includes redacted and blurred examples of these recordings. **Why it matters** FaceStealer shows how North Korean threat actors are moving beyond fake job offers and phishing emails toward highly personal, trust-based social engineering. Because invitations come from real, hijacked accounts of known contacts, and the “person” on the call looks and moves like someone the victim knows, traditional warning signs mostly disappear. The long wait between compromise and theft also means organizations may already be compromised without knowing it. Targeting open-source maintainers raises the risk of supply chain attacks with impact well beyond individual victims. - **Use the official app and an invite code:** Join meetings through the official Zoom or Teams application with an invite code, rather than clicking links that open web versions. Be especially careful with invitations from infrequent or new contacts. - **Keep your webcam off at first:** Don’t turn on your camera until you can see, hear, and talk with the person who invited you. This gives you a chance to check the call is genuine before your own video can be recorded. - **Never run “update” commands during a call:** If a video chat service asks you to update, do not run scripts or paste code into the command line or terminal. Update the app separately, or join through the web version with the invite code. - **Inspect calendar invites:** North Korean hackers often leave video chat links out of Calendly and other scheduling emails and send the malicious link closer to the meeting time, to limit exposure of their infrastructure. - **Confirm through a second channel:** Check the meeting with the person who invited you through a different method from the one they used. For example, if the invite came on Telegram, confirm it by text or phone. - **Secure messaging apps:** Turn on multifactor authentication and login alerts on Telegram, WhatsApp, Slack, and other apps, and use expiring messages to limit chat history if an account is hijacked. The hackers take over accounts by logging in from another device, changing recovery details such as the phone number, then closing your sessions. - **Protect your cryptocurrency:** Keep only small amounts in browser extension wallets. Keep larger balances in a separate hardware wallet or with an exchange. Never store recovery phrases or private keys on your devices. North Korean hackers copy recovery phrases, quietly monitor balances on the blockchain, and empty the wallet after a large transfer. **If you think you’ve been compromised** - **Move your crypto right away:** Create a new wallet with new seed phrases, on a device that was not used to talk with the hackers, and transfer your assets to it. The hackers have stolen funds months and even years after the initial compromise. - **Secure your accounts:** Change passwords, log out of all active sessions, and enable multifactor authentication on Telegram, WhatsApp, other messaging apps, and sensitive accounts, including developer accounts. - **Warn your contacts and employer:** Tell friends and contacts that your accounts may have been hijacked and that the attackers may impersonate you with prerecorded webcam video. If you talked with the hackers on a work device, or keep work files on a personal device, tell your employer. Failing to notify them puts others at risk and helps the scheme continue. - **Change all passwords.** - **Recover lost accounts:** If you lose access to messaging or developer accounts, ask the platform to shut down the account or restore it to you. - **Report it:** File a report at [IC3.gov](https://www.ic3.gov/?ref=cms.thedarkwebnews.com) with the keyword **“FaceStealer.”** **Further technical reading and IOCs** The FBI credits research by Arctic Wolf, Jumpsec, and the Microsoft Threat Intelligence Center (MSTIC), whose reports include detailed technical analysis and lists of indicators of compromise. The FBI also thanks Arctic Wolf for its contributions on North Korea’s use of social engineering and deepfake production. - Arctic Wolf: [Still in the Meeting: BlueNoroff Six Months On](https://arcticwolf.com/resources/blog/still-in-the-meeting-bluenoroff-six-months-on/?ref=cms.thedarkwebnews.com) - Jumpsec: [Inside a DPRK BlueNoroff ClickFix Kit](https://www.jumpsec.com/guides/inside-a-dprk-bluenoroff-clickfix-kit/?ref=cms.thedarkwebnews.com) - Microsoft: [Dissecting Sapphire Sleet’s macOS Intrusion from Lure to Compromise](https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/?ref=cms.thedarkwebnews.com) Read the full FBI FLASH here: [https://www.ic3.gov/CSA/2026/261112.pdf](https://www.ic3.gov/CSA/2026/261112.pdf?ref=cms.thedarkwebnews.com)