FaceStealer: North Korean hackers invite crypto and open-source developers to fake Zoom, Teams or Meet calls with recorded video of people they know, then a fake audio 'fix' installs malware (FBI, $400M+ stolen)

North Korean hackers (Sapphire Sleet / UNC1069 / BlueNoroff / APT38 / Stardust Chollima) send video meeting invitations from social media and messaging accounts stolen from earlier victims, so the invite comes from someone the target knows. The meeting runs on an imposter version of Zoom, Microsoft Teams or Google Meet and plays prerecorded webcam video of the target's contacts or AI deepfakes of well-known crypto figures. The hackers then fake a technical problem (usually 'we can't hear you') and send a link or prompt to 'fix' it, which installs malware. They also record the new victim's webcam to use against the next target. The FBI and DOJ say it stole more than $400M in crypto over the last 18 months, and the FBI seized the cloud infrastructure and 900+ victim webcam videos (announced 12 Nov 2026). Targets are people in crypto and Web3, and more and more open-source developers and maintainers, whose repository accounts the hackers want for supply-chain attacks. The FBI says one maintainer's computer was used to add malicious code to widely used software, and it was caught before it spread far; which project is unknown. Theft and account hijacking can happen months to more than a year after the infection.