FBI: North Korea's fake Zoom and Teams calls stole $400 million. Never run a fix a meeting asks you to run.

An FBI alert dated November 12 describes FaceStealer, a North Korean scheme that hijacks a contact's Telegram or LinkedIn account, invites you to a fake Zoom or Teams call, plays secretly recorded webcam video of people you know, then asks you to run an audio fix that installs malware. The FBI says it took more than $400 million in crypto in 18 months and seized 900+ victim videos.

If a contact invites you to a Zoom or Teams call and, once you’re in, asks you to click an update, run a script or paste a command to fix your audio, leave the call. That request is the attack. The FBI says North Korean state hackers have used this exact routine to steal more than $400 million in cryptocurrency over the past 18 months. Join meetings only from the installed Zoom or Teams app with a meeting ID, and keep your camera off until you can see and talk to the person who invited you.

How FaceStealer works

The FBI laid out the scheme in a FLASH alert dated November 12 (number AC-111226-MS) and calls it FaceStealer. It attributes the activity to the North Korean group tracked as Sapphire Sleet, UNC1069, BlueNoroff, APT38 and Stardust Chollima. Each victim becomes the bait for the next one:

1. A real account goes bad. The hackers start from someone they already compromised. They take over that person’s Telegram account or another messaging app, read the chat history and lock the owner out. The FBI says they have also hijacked or created accounts on LinkedIn, Slack and Discord.
2. A familiar contact asks to meet. Posing as that person, they message the victim’s contacts to “catch up,” “discuss collaboration” or “talk about investment opportunities,” sometimes tailored to past chats. A Calendly invite follows.
3. The link arrives late. Shortly before the meeting, the target gets a link that looks like Zoom or Teams. It points to a lookalike domain such as uu01webzoom.us or teams.livemeet.us, which hosts a copy of the meeting interface.
4. Familiar faces appear. Once the target is admitted, the hackers play webcam video they secretly recorded of the earlier victim, often with more clips so the call looks like it has several participants.
5. The “fix.” The fake contact messages that the target can’t be heard and walks them through clicking an update prompt, running a script or pasting code into Terminal. The FBI says that installs a browser cookie stealer, keyloggers, screen capture tools and a backdoor. The fake meeting page had already started recording the target’s own webcam.

The new victim’s crypto, contacts and video then feed the next round. The FBI says it has seized more than 900 victim webcam videos used this way. In several cases the hackers waited months to over a year after the break-in, watching wallet balances on the blockchain before stealing the funds.

Who is being targeted

The FBI’s alert is addressed to people in the crypto and web3 industry and to open-source software maintainers. Most people outside crypto won’t be the end target, but anyone with a crypto wallet, signing keys or a well-known contact list can become a link in the chain. Arctic Wolf, one of the firms the FBI credits, counted 677 targets in 58 countries and says more than 80% were founders and C-suite executives, according to The Hacker News.

The FBI also says the same trick nearly poisoned a major JavaScript library this year. The hackers lured its maintainer into a fake Teams call with several participants, including one he recognized, got him to run the “corrective” steps, then used his access to publish malicious dependencies. The FBI says the library gets tens of millions of downloads a week and that quick detection stopped the attack. The Hacker News identifies the earlier target as the Axios npm maintainer. The FBI adds that it knows of other attempts against npm maintainers and, recently, Rust crate maintainers.

The group has started making AI deepfakes of well-known crypto figures from public photos and video to drop into these calls. The FBI says the scheme still relies overwhelmingly on real stolen webcam footage, and that its advice works against both.

What to do before your next call

These steps come from the FBI’s recommendations, in plain terms:

• Join from the app. Open the installed Zoom or Teams app and enter the meeting ID instead of clicking a web link, especially when the invite comes from someone you rarely talk to.
• Camera off until you know who’s there. Wait until you can see, hear and talk with the person who invited you before you turn on your webcam.
• Never paste a command to fix a meeting. If a call says your client needs an update, close it and update the app yourself from the app or its official site.
• Watch for missing links. The FBI says these scheduling invites often arrive without a meeting link, which then shows up just before the call.
• Confirm on a second channel. If the invite came on Telegram, confirm by text or phone with a number you already had.
• Lock down your messaging apps. Turn on two-factor authentication and login alerts in Telegram, WhatsApp and Slack, and use disappearing messages so a hijacked account exposes less history.
• Keep keys off your laptop. Keep only small amounts in browser extension wallets, put larger balances on a hardware wallet or with an exchange, and never store recovery phrases or private keys on your devices.

If you think you joined one of these calls, the FBI says to move your crypto to a new wallet with a new seed phrase, created on a device you didn’t use for the call. Then change your passwords, sign out of every messaging app session, add two-factor authentication, and warn your contacts and your employer that someone may be impersonating you on video. Report it at IC3.gov with the keyword “FaceStealer.”

A familiar face on video no longer proves anything

This is our analysis. Remote companies treat a video call as the strongest check they have: if you can see a person’s face, you trust the request. FaceStealer breaks that by replaying real footage of people you know. It works on the same fear as the AI-cloned CEO calls that took $129 million: nobody wants to be the one holding up a meeting. And Microsoft’s deepfake warnings for Teams would not help here, because the fake meeting never runs on Microsoft’s servers. The fix costs nothing. Make “we never run commands from a meeting” a written rule for your team, and treat any meeting that asks you to type something as a failed meeting. If you maintain a package other people install, this is now aimed at you as much as at anyone holding crypto.

Primary source: FBI FLASH AC-111226-MS, “North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M ‘FaceStealer’ Crypto Theft Scheme”, November 12, 2026. The FBI credits Arctic Wolf, JUMPSEC and Microsoft Threat Intelligence for technical reports with indicators of compromise.