FBI and DOJ Disrupt North Korea’s FaceStealer Scheme

The FBI and the US Department of Justice have disrupted cloud infrastructure used in a North Korean fake video-call operation the FBI calls FaceStealer, a scheme they say has stolen more than $400 million in cryptocurrency over the last 18 months. Anyone invited to a meeting should verify the invitation out of band, never run a “fix” offered in the call, check the meeting URL, and report suspected cases to IC3.gov with the keyword FaceStealer.

The Justice Department announced the action on 12 November 2026, through the US Attorney’s Office for the Central District of California. It said the work included “the seizure of cloud-based infrastructure used in the FaceStealer social engineering scheme that has resulted in the theft of more than $400 million worth of cryptocurrency.” The same release says the scheme “has resulted in the theft of more than $400 million in the last 18 months and the attempted compromise of individuals involved in the open-source software supply chain.” Pursuant to a federal warrant, the FBI “seized over 900 webcam videos of FaceStealer victims.”

The FBI published the same date a FLASH advisory, AC-111226-MS, marked TLP:CLEAR, and a dedicated FaceStealer page. Both the department and the FLASH attribute the activity to North Korean groups “known publicly by the names Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.” Lazarus is not among the names the FBI lists.

How the scheme works, and what to do

According to the Justice Department and the FLASH, targets are lured to imposter versions of Zoom, Microsoft Teams and Google Meet with invitations sent from hijacked accounts, including on Telegram, LinkedIn, Slack and Discord. Once a target joins, the operators play a prerecorded webcam video of a previous victim, or victims the target knows, and record the new arrival’s camera. During the meeting they introduce a mock technical error, such as a claim that the target cannot be heard, and offer a “fix.” That “fix” installs malware. The FBI says that in several cases the theft of cryptocurrency, and the hijacking of communications accounts, came “months to over a year after the initial compromise.”

The FLASH gives two typo-squatted domains as examples of meeting links controlled by the operators: uu01webzoom.us and teams.livemeet.us. It says the operators often leave the video-chat link out of a Calendly or other scheduling email, and send the malicious link closer to the meeting time.

The Justice Department says the hackers “also use super intelligence (SI) to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries.” That is the department’s own wording. The FLASH treats deepfakes as an emerging technique and says the FaceStealer scheme “currently continues to overwhelmingly rely on the theft of genuine victim videos.” The more than $400 million figure is attached to the scheme as a whole over 18 months, not to deepfakes alone.

The FBI’s defensive advice is practical. Use the official video-chat application and an invite code, rather than a web link, especially for invitations from infrequent or new contacts. Leave the webcam off until you can see, hear and communicate with the person who invited you. If a meeting offers an update or a “fix,” never run a script or paste code into a terminal to apply it; update the official app separately, or join with an invite code. When possible, confirm a scheduled call with the person who invited you through a different channel from the one that delivered the invitation. File a report at IC3.gov with the keyword “FaceStealer.”

The FLASH also describes attempts to use the same method against open-source software developers and maintainers, including a near-miss against a widely downloaded JavaScript library, and further attempts aimed at maintainers with repositories on the JavaScript registry and, more recently, Rust crates. The Justice Department likewise says the operators have increasingly targeted people involved in developing and maintaining open-source software, in what “appears calculated to enable software supply-chain attacks.”

The same Justice Department release also described, as a separate matter, a court-authorised seizure or restraint of more than $1.2 billion tied to a Binance theft, with more than $2.7 billion frozen, a development TSN is following on its existing Binance incident post.

Other recent US actions against North Korean cyber-enabled activity have included Microsoft’s account of North Korean hackers using AI to scale familiar attacks, charges over an alleged IT worker and laptop-farm scheme, and Treasury sanctions on people accused of supporting IT worker schemes. Those are different cases from FaceStealer.

Analysis

The first fact worth keeping straight is the money. More than $400 million is the Justice Department’s and the FBI’s figure for the FaceStealer scheme over 18 months. It is not a measure of how much was stolen by deepfakes. Officials describe prerecorded webcam videos of earlier victims as the core of the ruse, and they describe “super intelligence (SI)” deepfakes, in the department’s phrase, as an added technique. The FBI has seized more than 900 of those victim videos. That library, not a single deepfake, is what made the meetings look like trusted contacts.

The defensive advice follows directly from that design. The meeting looks real because the invitation comes from a hijacked account and the face on screen may be a real, earlier victim. Checking the URL, using an official app and an invite code, and verifying the invitation out of band are ways of testing the channel before the recording starts. The “fix” in the chat is the moment of infection. Never running it is the simplest way to break the chain, even if the person on screen appears to be someone you know.

A seizure of cloud infrastructure and of those videos is a disruption, not a declaration that the method has vanished. The FLASH still tells people how the lure works, still lists typo-squatted domains, and still asks for IC3 reports under the FaceStealer keyword. Open-source maintainers are now in the same warning as cryptocurrency staff, because one compromised repository account can be turned into a supply-chain problem. The near-miss described by the FBI is a reminder of that risk, not evidence that a named library was successfully poisoned.

The Binance figures in the same Justice Department release belong to a different case and should be left there. More than $1.2 billion is under court-authorised seizure or restraint, with forfeiture still pending, and more than $2.7 billion is described as frozen by government and private-sector efforts. Those amounts are not a return of funds, and they are not part of the $400 million FaceStealer tally.