FaceStealer: A Fake Zoom Call That Replays a Stolen Webcam Video
The FBI's 12 Nov 2026 FaceStealer advisory: North Korean hackers play stolen webcam recordings in fake Zoom calls, then talk targets into pasting malware.
AegisAI Threat IntelligenceAegisAI Threat Watch · Social engineering
FaceStealer: A Fake Zoom Call That Replays a Stolen Webcam Video
The FBI's FLASH advisory of 12 November 2026 describes North Korean hackers who use hijacked chat accounts and replayed webcam recordings of earlier victims to talk crypto and open-source workers into infecting themselves.
- What
- A hijacked chat account invites a contact to a fake Zoom call that replays stolen webcam video, then asks for a pasted command.
- Who it hits
- Crypto and web3 staff and open-source maintainers, per the FBI.
- Why filters miss it
- The invite comes from a real account the target knows, and the meeting link appears only shortly before the call.
- Do today
- Require meetings through the installed app with an invite code, and ban pasting commands to fix a call.
Reported by the FBI, 12 November 2026.
FaceStealer is an FBI-named North Korean scheme that lures crypto and open-source workers into fake Zoom calls showing stolen webcam recordings of known contacts.
FaceStealer is the FBI's name for the scheme. A typosquatted domain is a deliberately misspelled or altered web address registered to catch people who trust a link that looks right. An imposter meeting is a copy of Zoom, Teams or Google Meet that the attacker hosts and controls. The FBI says the actors have stolen more than $400 million in cryptocurrency over the past 18 months with this method.
Analysis based on FBI FLASH AC-111226-MS, published on 12 November 2026. The FBI attributes the activity to North Korean state-sponsored hackers known as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. A related Threat Watch article covers an AI deepfake impersonation attack that starts with a setup email.
Source: FBI FLASH AC-111226-MS, 12 November 2026.
Key judgments
- The invite does not come from a stranger. The FBI says the actors take over a real Telegram or other chat account, read its contacts and chat history, and message those contacts as the account owner. Slack, LinkedIn and Discord accounts have also been hijacked or newly created for first contact.
- The call itself is the lure. After the target is admitted to a fake Zoom or Teams session, the actor plays stored webcam video of the earlier victim, often with extra videos so that several people seem present.
- The infection is self-inflicted. The actor, posing as the victim, claims there is an audio problem and guides the target to click an update prompt, run a script or paste code into a terminal. The FBI says the webcam had been recording since the first click on the imposter link.
- The harm outlasts the call. In several cases the actors stole cryptocurrency and hijacked accounts months to over a year after the first compromise, waiting for wallet balances to grow.
- Open-source maintainers are targets too. The FBI says the same method nearly poisoned a significant JavaScript library with tens of millions of downloads a week, and that attempts were also made against npm and Rust crate maintainers.
Evaluating email security tools? The 2026 Buyer's Guide to Email Security has nine evaluation areas and the questions to ask vendors. Get the guide.
How does FaceStealer turn one victim into the next?
The FBI describes a loop of six stages. Each new victim supplies the account, the contacts and the webcam video for the next round.
- The actors already control a victim's device. They have scanned it for wallets and seed phrases, taken over and locked the owner out of the victim's Telegram or other encrypted chat account, copied contacts and chat histories, and secretly recorded the victim's webcam while the victim waited for a video chat to start.
- Using that account, they message the victim's contacts to propose a Zoom or Teams meeting. The FBI says the pretext is typically to catch up, discuss collaboration or talk about investment opportunities, and that high-value contacts get messages tailored to past chats.
- When a contact agrees, the actors send a Calendly or other calendar invite to fix a time. Shortly before the meeting, the hijacked account sends a link that looks like Zoom or Teams. It points to one of many typosquatted domains the actors registered in advance, and it opens a copy of the meeting service on a server they control.
- The target is admitted from a lobby and sees the earlier victim, played from stored video, usually with other recorded participants.
- After a small delay, the actor posing as the victim says there is an audio or technical problem and guides the target to click an update prompt, run a script or paste code into a terminal. The FBI says that eventually installs a browser cookie harvester, keyloggers, screen capturers and a backdoor.
- With the new victim's video and device, the cycle returns to stage 1. The actors can also steal cryptocurrency or use the victim's access to an employer network or a software repository account.
Source: FBI FLASH AC-111226-MS, 12 November 2026, Technical Details.
What a target sees at each stage
The table pairs what the target experiences with what the FBI says is happening. It is AegisAI's arrangement of the FBI's description.
| Stage | What the target sees | What is happening |
|---|---|---|
| Invite | A catch-up or investment message from a known contact | The contact's chat account is under attacker control |
| Scheduling | A Calendly invite, often with no meeting link | The link is held back to limit exposure of the attacker's infrastructure |
| Link | What looks like a Zoom or Teams link, sent shortly before the call | A typosquatted domain that serves a copy of the meeting service |
| Call | The contact and other colleagues in the lobby, then on screen | Stored webcam video of earlier victims |
| Fix | A request to repair an audio fault | An update prompt, script or pasted command that installs malware |
| Aftermath | Nothing visible | The webcam recorded from the first click; accounts and wallets are watched |
Where the lure touches email
The FBI documents the first contact and the meeting link as chat messages. It also says Calendly or other calendar services are used to set the time, and that the actors frequently leave the video chat link out of the scheduling emails and send it closer to the meeting. AegisAI's reading is that the scheduling email is the only step in this chain that can reach a mailbox, and it may carry no link at all.
What does the scheme do to open-source maintainers?
The FBI says most FaceStealer targets are people and companies from which the actors can steal cryptocurrency, but the same technique has been used on software maintainers to reach the repository accounts they control. If a maintainer's account distributes malicious code, one victim can become potentially millions.
The FBI's example is a significant open-source JavaScript library with tens of millions of downloads a week. The actors used several interactions to bring the maintainer into a fake Teams call that included at least one person the maintainer recognized. The maintainer followed the "corrective" steps, the actors used the access to create malicious dependencies that would be downloaded with legitimate library downloads, and the compromise was detected and answered quickly. The FBI is aware of several other attempts against maintainers of npm packages and, recently, Rust crates.
Where deepfakes fit
The FBI says the actors have begun using what its advisory calls "super intelligence" (SI) to generate deepfake video of well-known figures in the cryptocurrency and web3 industries, built from public photos and video. Deepfakes can replace or sit beside the stolen victim footage. The FBI adds that the scheme still overwhelmingly relies on genuine stolen videos, and that deepfake quality only needs to pass as webcam video.
How can an organization spot a FaceStealer call?
Look at the path to the call, not the face on it. The FBI's recommendations and the reported chain suggest controls at four points: the account, the link, the call and the command line.
| Control | What it sees in this campaign | Result |
|---|---|---|
| Sender or display-name check | A genuine hijacked account that belongs to a known contact | Nothing to flag |
| Brand or domain-spoofing filter | The meeting domain is a typosquat, but it arrives in a chat message | Does not see it unless the chat link is scanned |
| Rule: join only through the installed app with an invite code | The imposter web page is never opened | Can stop the lure |
| Rule: webcam off until the inviter is confirmed | The actor cannot start recording the target's video | Limits the damage |
| Block on pasting commands to fix a call | The step that installs the malware | Can stop the infection |
| Confirmation on a second channel | The real contact says they sent nothing | Can expose the hijack |
| Reading the scheduling email and its link | A calendar invite with a missing or lookalike meeting link | Can be flagged when it arrives by email |
AegisAI's reading of the reported chain. The app, webcam, command and second-channel rows follow the FBI's recommendations.
A friend's message, a friend's face and a friend's request to fix the sound. Every step looks like someone the target trusts, until the pasted command runs.
AegisAI Threat IntelligenceWhat this means for a security team
This section is AegisAI's analysis. The FBI aims the advisory at the cryptocurrency and web3 industry and at open-source maintainers, but the technique does not depend on crypto: any employee who joins a call with a known contact and then runs a pasted command gives the actor a device, saved sessions and a webcam. The reported delay of months to over a year before funds were taken means a quiet compromise is not a safe one.
Three questions settle the exposure: whether staff may join meetings through a link in a chat message, whether a pasted command can run on a work device without a block or an alert, and whether the organization has a routine for telling contacts that an account may be impersonating its owner.
Why standard controls miss it
This section is AegisAI's analysis. The invite is sent from an account that really belongs to the contact, so there is no forged sender or mismatched display name to catch. The meeting page is a working copy of a real video client, not a credential form, and its link appears only shortly before the call. The social engineering then happens inside software the target already trusts, with a face the target recognizes. What remains visible is the request: a scheduling message, a link that nearly matches a known meeting service, and later a demand to run a command.
How AegisAI protects against it
AegisAI has not observed this campaign. The FBI documents the invite and the meeting link as arriving over chat apps, not email, so the approach below applies only where part of the chain reaches a mailbox, such as a scheduling email or a link that carries a lookalike meeting address. It does not cover a hijacked chat account, the call itself or what runs on a device after a pasted command.
AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it. More on how that works: inbound email security.
When a lure or a compromised session is caught, the response compounds: the message is withheld at classification, copies already delivered are retracted, rewritten links refuse a late visit, the account's outbound and internal mail gets rescanned, and lateral phishing attempts to colleagues are blocked at the same bar rather than treated as a fresh, unrelated message.
How AegisAI stops credential phishing, 48 seconds
Recommendations for defenders
- Set a policy that staff join Zoom, Teams and Google Meet calls through the installed application with an invite code, not through a link in a chat or calendar message, especially for new or infrequent contacts, as the FBI advises.
- Require staff to keep the webcam off until they can see, hear and speak with the person who invited them, and to confirm unexpected meetings on a second channel such as a phone call.
- Block or alert on scripts and pasted terminal commands run from a meeting prompt, and tell staff that call software is updated separately through its official source, never through steps given in a call.
- Treat a calendar invite that withholds the meeting link until later as a warning sign, and watch for lookalike Zoom and Teams domains in mail and web traffic.
- Add multifactor authentication, login alerts and expiring messages to Telegram, WhatsApp, Slack and other chat apps used for work, and keep only small balances in browser-extension wallets.
FAQ
What is FaceStealer and how does the scam work?
FaceStealer is the FBI's name for a North Korean scheme that hijacks a victim's chat account and uses it to invite that victim's contacts to a fake Zoom or Teams call. The call plays stored webcam video of the earlier victim, then guides the target to run a command that installs malware, according to the FBI's 12 November 2026 advisory.
Who is behind FaceStealer?
The FBI attributes FaceStealer to North Korean state-sponsored hackers known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima. It says they have stolen more than $400 million in cryptocurrency over the past 18 months.
How do I tell a fake Zoom or Teams invite from a real one?
Check the address and the timing. The FBI says the link arrives shortly before the call and points to a typosquatted domain such as uu01webzoom[.]us. Joining through the installed app with an invite code, and confirming the meeting with the inviter on another channel, avoids the imposter page.
What should I do if I already ran a command to "fix" audio on a call?
The FBI advises creating a new cryptocurrency wallet with new seed phrases on a device that was not used to talk to the hackers and moving the funds there. It also advises securing chat and developer accounts by changing passwords, logging out all sessions and adding multifactor authentication, then telling contacts and employers, and filing a report at IC3.gov with the keyword "FaceStealer".
For researchers
What the reporting does not tell us 4 gaps
Delivery by email. The FBI documents the invite and meeting link as chat messages. It mentions scheduling emails only in the recommendations, and publishes no email sample.
Scale. The FBI gives $400 million over 18 months and more than 900 seized videos. It does not say how many individuals or organizations were affected.
Malware. The advisory names the capabilities (cookie harvester, keyloggers, screen capturers, backdoor) but gives no file names or hashes. It points to separate vendor reports for fuller indicator lists, which are not cited here.
Indicator lifespan. The advisory lists two example domains. The FBI says the actors registered many, so any single domain ages quickly.
Reported indicators 2 items
Indicators from the FBI's advisory, defanged. Infrastructure changes quickly: treat these as historical indicators, not a live blocklist.
| Type | Indicator | Role |
|---|---|---|
| Domain | uu01webzoom[.]us | Typosquatted domain imitating a Zoom meeting link |
| Domain | teams.livemeet[.]us | Typosquatted domain imitating a Teams meeting link |
MITRE ATT&CK mapping 6 techniques
These techniques are AegisAI's mapping of the FBI's description. IDs and names were checked against attack.mitre.org on 14 November 2026.
| ID | Name | Use in this campaign |
|---|---|---|
T1586.001 | Compromise Accounts: Social Media Accounts | Victims' real chat accounts are taken over and reused as the trusted sender of each new invite. |
T1583.001 | Acquire Infrastructure: Domains | Many typosquatted Zoom and Teams domains are registered in advance. |
T1566.003 | Phishing: Spearphishing via Service | Invites and meeting links are sent through chat and social platforms rather than email. |
T1204.004 | User Execution: Malicious Copy and Paste | The target pastes code into a terminal to fix a staged audio problem. |
T1125 | Video Capture | The target's webcam is recorded from the first click on the imposter link. |
T1539 | Steal Web Session Cookie | The installed malware includes a browser cookie harvester. |
References 2 sources
- FBI Internet Crime Complaint Center (12 November 2026). FLASH AC-111226-MS: North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M "FaceStealer" Crypto Theft Scheme. ic3.gov
- MITRE ATT&CK. Techniques T1586.001, T1583.001, T1566.003, T1204.004, T1125 and T1539. attack.mitre.org
Every email, investigated.
When a scheduling email with a meeting link reaches a work inbox, see how AegisAI reads the request and where the link leads.
Phishing that reaches the inbox, stopped before anyone clicks.
Book a demoRelated posts
More from the AegisAI blog.