The FBI and the US Justice Department have seized cloud servers that North Korean hackers used to run FaceStealer, a scam that invites you to a video call, replays a friend’s recorded face at you, then talks you into installing malware. The FBI puts the losses at more than $400 million in crypto across the last year and a half.
Agents also took over 900 webcam recordings of earlier victims, the footage the hackers used to pose as people their targets know. Most targets work in crypto and web3, but the FBI says the same call is now being aimed at open-source software maintainers, to get at code that millions of people download.
The Justice Department announced the action on 12 November, and the FBI’s alert of the same date walks through each step. It begins with an account the hackers have already hijacked, on Telegram, LinkedIn, Slack or Discord. They message that person’s contacts to propose a catch-up, a collaboration or an investment chat, send a calendar invite, and only shortly before the meeting send the link. That link leads to a copy of the Zoom or Teams page hosted by the hackers on a misspelled look-alike address, such as uu01webzoom.us or teams.livemeet.us.
Once the target is admitted, the hackers play the hijacked contact’s stored webcam clip, often adding more clips so the room looks full. After a short pause the “contact” messages that the target’s audio is not working and walks them through a fix: click an update prompt, run a script, or paste code into a terminal. What it actually installs is spyware: it steals browser cookies, logs keystrokes, captures the screen and opens a backdoor. The hackers had already started recording the target’s own webcam when the link was first opened, so the new victim becomes the next face in the scheme.
The theft does not always follow at once. In some cases the money went months, even over a year, after the first infection, once the wallet had filled up. The FBI also says the hackers now use AI to build deepfake videos of well-known crypto figures, though the scheme still relies overwhelmingly on real stolen video.
The supply-chain angle is the part that reaches beyond crypto. Earlier this year, the alert says, hackers lured the maintainer of a major JavaScript library into a fake Teams call with several participants, one of them someone he recognised. After he followed the “fix”, they used his access to create malicious dependencies that would have shipped with legitimate downloads of a library that gets tens of millions of downloads a week. Quick detection stopped it. The FBI knows of other attempts against maintainers on npm and, more recently, Rust crates.
The Justice Department announced a second action the same day that is separate from FaceStealer: the freezing of assets from the theft of more than $6 billion from Binance around 29 October, which the FBI blames on a different North Korean military group it calls TraderTraitor. About $2.7 billion has been frozen so far and courts have authorised seizing or restraining more than $1.2 billion of it. That is the same theft in the FBI’s earlier attribution to North Korea.
The FBI’s advice is practical for anyone who takes video calls with people they have only chatted to. Join through the official Zoom or Teams app with an invite code instead of a link, keep your webcam off until you can see and hear the person who invited you, and never paste commands or run scripts to fix a call. Confirm the meeting with the person on another channel, and turn on multi-factor authentication and login alerts for Telegram, WhatsApp and Slack. Anyone who thinks they were hit should move their crypto to a new wallet from a clean device, change passwords, log out every session, warn their contacts, and report it to the FBI at IC3.gov, using FaceStealer as the keyword.
