FaceStealer: North Korea's fake video calls run mostly on real, stolen webcam footage — not deepfakes

The FBI and the Justice Department said on November 12, 2026 that they had seized the cloud infrastructure behind "FaceStealer", a North Korean scheme they link to more than $400 million in cryptocurrency theft over 18 months, along with more than 900 secretly recorded webcam videos of victims. The scheme turns each victim into bait for the next: their hijacked chat accounts send the invitations, and their stolen webcam footage plays in fake Zoom and Teams calls that end with a "fix" that installs malware. The AI deepfakes get the headlines, but the FBI's own advisory says the scheme "currently continues to overwhelmingly rely on the theft of genuine victim videos", and that changes what defenders should look for.

The short version

Most of us treat a video call as proof that we are talking to the right person. If a colleague or a business contact we know appears on camera, we relax.

FaceStealer is built to exploit that. According to the FBI advisory, the attackers first break into one person's computer and take over their messaging accounts. They also quietly record that person's webcam. They then use the stolen account to invite the victim's own contacts to a video call: catching up, a collaboration, an investment idea. The link goes to a look-alike Zoom or Teams page run by the attackers. When the new target joins, they see recorded clips of the person they know, and sometimes other "participants", playing like a live call. After a few moments there is a fake "audio problem", and the target is told to install an update, run a script or paste a command into a terminal. That installs the malware, the new victim's webcam gets recorded, and the cycle starts again with their contacts.

It works like a chain letter that carries a familiar face. Spotting AI fakes won't save you here, because most of the video is real. What protects you is a rule: never run something to "fix" a meeting, and confirm unexpected calls through a channel you already trust.

Timeline

• June 11, 2025 — Huntress is contacted by a partner about a suspicious "Zoom extension" at a cryptocurrency foundation. Its June 18, 2025 write-up describes a group Zoom call that "contained several deepfakes of known senior leadership", a broken microphone and a malicious AppleScript. Huntress attributes it with high confidence to BlueNoroff (TA444).
• Late 2025 – March 2026 — More than 80 typo-squatted Zoom and Teams domains are registered on the same infrastructure, according to Arctic Wolf.
• April 27, 2026 — Arctic Wolf Labs documents the fake-meeting pipeline and at least 100 additional targets in 20+ countries.
• On or about October 29, 2026 — Members of the North Korean military that the FBI calls "TraderTraitor" steal more than $6 billion in virtual assets from Binance, according to the DOJ. (We covered Binance's own account here.)
• November 12, 2026 — The FBI publishes FLASH AC-111226-MS (TLP:CLEAR) on FaceStealer and launches fbi.gov/facestealer. The DOJ (press release 26-1356) announces the infrastructure seizure, the seizure of 900+ webcam videos, and the seizure or restraint of more than $1.2 billion of the stolen Binance assets. Arctic Wolf publishes a six-month follow-up.

What we know

The seizure and the money. The DOJ says FaceStealer has caused "the theft of more than $400 million in the last 18 months", that authorities disrupted its cloud infrastructure in a case run out of the Central District of California, and that "pursuant to a federal warrant, the FBI seized over 900 webcam videos of FaceStealer victims." The same release covers a separate action: more than $1.2 billion of the cryptocurrency stolen from Binance was seized or restrained, and government and private-sector efforts have frozen more than $2.7 billion of the stolen assets in total. The DOJ ties the Binance theft to TraderTraitor, not to FaceStealer.

Attribution. The FBI and DOJ attribute FaceStealer to North Korean state-sponsored hackers tracked under several names. The DOJ lists Sapphire Sleet, BlueNoroff, APT38 and Stardust Chollima. Huntress (2025) and Arctic Wolf (2026) independently attributed the fake-meeting intrusions they investigated to BlueNoroff.

How the scheme works, per the FBI. The FLASH describes six stages: compromise a first victim and search the device for wallets and seed phrases; take over messaging accounts ("The actors have hijacked accounts on platforms including Telegram, LinkedIn, Slack, and Discord"); send a calendar invite and, shortly before the meeting, a link to a typo-squatted Zoom or Teams site; play prerecorded video of the victim and other fake participants; fake an audio problem and steer the target into installing an "update", running a script or pasting code; repeat with the new victim's contacts. The FBI lists the installed tools as "a browser cookie harvester, keyloggers, screen capturers, and a backdoor". The attackers also take their time. The FBI says they "waited for the balances of cryptocurrency wallets to increase", and the DOJ says theft and account hijacking happened in several cases "several months to more than a year after the initial compromise."

The AI part, in the government's words. The DOJ release says: "The North Korean hackers also use super intelligence (SI) to develop deepfake videos of well-known and influential individuals often in the cryptocurrency and web3 industries." The FBI FLASH puts it as "One of the more concerning ways they use SI is to generate deepfake videos", and adds: "The quality of the deepfakes only needs to be good enough to pass as webcam video." But it also says: "the FaceStealer scheme currently continues to overwhelmingly rely on the theft of genuine victim videos." (US federal documents this year use "super intelligence (SI)" for what most people call AI. The term says nothing about how advanced the tools are; we saw the same wording in the SDNY deepfake fraud case.)

The supply-chain angle. The DOJ says the actors "have increasingly targeted individuals involved in the development and maintenance of open-source software", trying to reach their devices and "the software repository accounts they control." The FBI describes a near-miss in which the hackers "used multiple interactions to lure a significant open-source JavaScript library" maintainer into a fake Teams call, infected the machine and tried to plant malicious dependencies, and other attempts against npm and, more recently, Rust crate maintainers. The FBI does not name the library. The Hacker News reports that the scheme was used against a maintainer of the Axios npm package. That identification comes from THN, not the FBI.

What the researchers add. Arctic Wolf's April report described a four-stage production pipeline: synthetic headshots that it identified as made with ChatGPT's GPT-4o model through C2PA provenance metadata; screen and webcam recordings; editing in Adobe Premiere Pro and FFmpeg; and pages that loop the clips in the browser. It found three kinds of "participant": stolen footage of earlier victims, AI-generated still images, and "deepfake composite video" with an AI face on captured body motion. It is explicit that "none of this is live". The only live capture was the victim's own webcam being exfiltrated. In its November 12 follow-up, Arctic Wolf says the media library now covers 677 individuals across 58 countries, 84% of them founders or C-suite executives. It warns that "these counts describe who the threat actor prepared material against, not confirmed compromises." It says the actor now combines tools including Google's generative AI, Grok Imagine, Wondershare AIGC and GPT-4o, and screen-records YouTube interviews and conference talks to reproduce specific executives. It also reports that the fake meeting is no longer the main lure: shared financial documents, fake PDF viewers, a fake media player called NovaStream, identity checks and security-audit workflows now do the same job. Its verdict on AI is measured: it sped the operation up, but "it has not fundamentally changed the intrusion mechanism."

Technical analysis

The intrusion is old. The distribution is new. Take away the video and FaceStealer is a ClickFix-style attack: the user is persuaded to run a command or install an "update" that the attacker supplies. What is different is how trust is borrowed. Classic phishing asks a stranger to trust a brand. FaceStealer asks you to trust a person you know, through that person's real account, showing that person's real face. Each compromise gives the attackers three things they need for the next round: an account with a history, a contact list, and fresh video of a face those contacts recognise. That is why, in the FBI's description, the pool of victims grows rapidly. Our assessment: it behaves like a worm whose propagation medium is human relationships rather than a software flaw, and it is harder to rate-limit, because every hop looks like normal business between people who know each other.

Why "spot the deepfake" fails here. A lot of corporate deepfake guidance tells staff to watch for odd blinking, mismatched lips or strange lighting. Against FaceStealer that advice mostly misses. By the FBI's account the bulk of the footage is genuine webcam video of the impersonated person, so there are no generation artefacts to find. Arctic Wolf made a related point about its own work: it labelled clips as deepfakes from provenance evidence, not appearance, and treated conventionally edited footage as "manual manipulation." The tells that do exist are behavioural. The other side doesn't respond naturally. Somebody else has an audio problem. A "fix" requires running something. The link arrived minutes before the call. Nothing an automated deepfake detector looks at will catch those.

Why technical controls didn't stop it. Three gaps line up. First, messaging accounts (Telegram, LinkedIn, Slack, Discord) are often personal, lack strong authentication and fall outside corporate monitoring, yet they carry business conversations, which is why the FBI's advice starts with MFA and login alerts there. Second, the malicious step is performed by the user, so many controls see an interactive command rather than an exploit. Arctic Wolf says it has added detections for PowerShell, curl-piped and osascript execution patterns, and that is the right layer. Third, the payoff is deliberately delayed: if theft comes a year after the infection, the link back to "that odd meeting" is easy to miss.

The developer angle is the enterprise risk. For most companies, the cryptocurrency losses are someone else's problem. A maintainer of a widely used package being infected through a fake call is everyone's problem: the FBI describes attempts to plant malicious dependencies after one such compromise. This links FaceStealer to the broader pattern Microsoft described last month of North Korean actors using AI mainly for fake identities and lures (our coverage). Our assessment: the maintainer's laptop, chat accounts and publishing tokens are now a supply-chain control point, and should be protected like a build server.

What is actually new about the AI angle. Generative tools fill in the gaps: synthetic headshots for placeholder participants, composite faces when no stolen footage fits, and increasingly well-known industry figures as lures. That makes the operation cheaper and easier to scale. It does not make the video interactive or the malware smarter. The FBI's line that deepfakes "only" need to pass as webcam video matters: webcam video is low-resolution and compressed, and people expect it to stutter, so the bar for a convincing fake is low.

What remains unclear

• The $400 million figure. The FBI and DOJ give a total over "the past 18 months" but no breakdown by victim, country or sector, and no count of confirmed victims. The FBI also doesn't say how much of the total, if any, came from incidents that began with a fake meeting rather than another lure.
• How the webcam recordings were made. The FBI says the hackers "secretly recorded the victim as they waited for the start of a video chat" but does not explain the mechanism, and its list of installed tools does not include webcam capture. Arctic Wolf describes the browser-side capture on the fake meeting page. Whether ongoing recording also happens through malware on infected machines isn't stated.
• Which library. The FBI does not name the JavaScript library whose maintainer was infected, and doesn't say whether any malicious dependency was actually published. The Axios identification is The Hacker News's. We have not seen it confirmed by the FBI or the maintainers.
• What was seized, exactly. The DOJ release does not list the seized domains or servers, and does not name the district that issued the warrant for the 900+ videos. It is not clear whether the seizure stops the operation or just disrupts current infrastructure. Arctic Wolf counts 98 high-confidence domains, 73 of them newly reported. Our assessment: infrastructure on that scale is cheap to replace.
• Counts that measure different things. Arctic Wolf's 677 people are targets for whom the actor prepared material. The FBI's 900+ are victim webcam videos. Neither is a count of compromised organisations, and they should not be added together or compared directly.

Lessons and what to do

For every employee (and for awareness programmes):

• A familiar face on a call is not proof of identity. Confirm unexpected meetings, especially about money, access or "an opportunity", through a channel you already have: a known phone number or your company directory, not the chat that sent the invite.
• Never run a script, paste a command or install an "update" to fix a meeting. The FBI's advice: update the app separately or rejoin through the official service.
• Join meetings through the official app, using a meeting ID, especially with new or infrequent contacts. Be wary of links that arrive minutes before the call.
• The FBI also suggests keeping your webcam off until you can see and talk to the person who invited you. That denies the attackers fresh footage.
• Update deepfake training from "spot the artefact" to "follow the procedure even when everything looks right".

For security teams:

• Detect the execution step, not the video. Alert on interactive PowerShell, curl-to-shell and osascript chains launched from browsers or terminals shortly after a meeting-related page visit.
• Watch for typo-squatted meeting domains and consider blocking newly registered domains impersonating Zoom and Teams at DNS or proxy level. Use the indicator (IOC) lists that security firms have published — the FBI's advisory points readers to those reports rather than listing them itself.
• Treat staff chat accounts used for business (Telegram, LinkedIn, Slack, Discord) as in scope: require MFA, and give employees a fast way to report "my account is messaging people I didn't".
• Keep endpoint and authentication logs long enough to investigate a theft that surfaces a year after the infection.

For developers and open-source maintainers:

• Use a separate, hardened machine or VM for publishing, require hardware-backed MFA on registry accounts (npm, crates.io, GitHub), and prefer short-lived, scoped publishing tokens or trusted publishing from CI.

For leadership and anyone holding digital assets:

• Executives and founders are the main target, according to Arctic Wolf. Give them extra protection: verification procedures for unusual meetings and transfers, and the FBI's custody advice — small balances in browser wallets, larger holdings in hardware or custodial storage, and seed phrases never stored on devices.
• If compromise is suspected, the FBI's steps are: move funds to a new wallet created on a clean device, change passwords and end all sessions, enable MFA, warn contacts and employers, and report to IC3.gov with the keyword "FaceStealer".

Our assessment: FaceStealer is a useful corrective to the deepfake hype. The most effective "deepfake" in this case is a real recording of a real person, replayed through their real account. Defences that depend on catching synthetic media will miss it. Defences that depend on procedure — out-of-band verification, no commands to fix a call, strong authentication on chat accounts — work whether the face is synthetic or stolen.

Sources

• FBI — FLASH AC-111226-MS on the "FaceStealer" scheme (TLP:CLEAR, November 12, 2026). FBI resource page: fbi.gov/facestealer (could not be fetched by us).
• US Department of Justice, Office of Public Affairs — Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency (press release 26-1356, November 12, 2026).
• Arctic Wolf Labs — Still in the Meeting: BlueNoroff Six Months On (November 12, 2026).
• Arctic Wolf Labs — BlueNoroff Uses ClickFix, Fileless PowerShell, and AI-Generated Fake Zoom Meetings to Target Web3 Sector (April 27, 2026).
• Huntress — Feeling Blue(Noroff): Inside a Sophisticated DPRK Web3 Intrusion (June 18, 2025).

Coverage:

• The Hacker News (Ravie Lakshmanan) — FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls (November 13, 2026).
• Cloud Security Alliance Labs — FaceStealer: Deepfake Video Meetings as a Self-Propagating Intrusion Chain (research note, November 2026).

Related on AI Cyber Brief: Binance's $6.34 billion theft · Microsoft on AI in North Korean tradecraft · The SDNY deepfake CEO fraud case