{"id":"CMP-202611-iqiske","kind":"campaign","aliases":[],"related":[],"title":"FaceStealer: North Korean hackers invite crypto and open-source developers to fake Zoom, Teams or Meet calls with recorded video of people they know, then a fake audio 'fix' installs malware (FBI, $400M+ stolen)","description":null,"summary":"North Korean hackers (Sapphire Sleet / UNC1069 / BlueNoroff / APT38 / Stardust Chollima) send video meeting invitations from social media and messaging accounts stolen from earlier victims, so the invite comes from someone the target knows. The meeting runs on an imposter version of Zoom, Microsoft Teams or Google Meet and plays prerecorded webcam video of the target's contacts or AI deepfakes of well-known crypto figures. The hackers then fake a technical problem (usually 'we can't hear you') and send a link or prompt to 'fix' it, which installs malware. They also record the new victim's webcam to use against the next target. The FBI and DOJ say it stole more than $400M in crypto over the last 18 months, and the FBI seized the cloud infrastructure and 900+ victim webcam videos (announced 12 Nov 2026). Targets are people in crypto and Web3, and more and more open-source developers and maintainers, whose repository accounts the hackers want for supply-chain attacks. The FBI says one maintainer's computer was used to add malicious code to widely used software, and it was caught before it spread far; which project is unknown. Theft and account hijacking can happen months to more than a year after the infection.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-13T15:03:57+00:00","products":[{"name":"Zoom","fixed":[]},{"name":"Microsoft Teams","fixed":[]},{"name":"Google Meet","fixed":[]},{"name":"Telegram","fixed":[]},{"name":"GitHub","fixed":[]},{"name":"npm","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"A video call invitation, often over Telegram, X, LinkedIn or another chat app, from a contact you know that leads to a meeting link not on the real zoom.us, teams.microsoft.com or meet.google.com domains; during the call an 'audio not working' or 'can't hear you' error with a link, download, SDK/driver update or Terminal/PowerShell command to fix it. If anyone on the team ran such a fix, treat the machine as compromised, even if it was months ago. The FBI has not published domains or file hashes in the sources we read (the FBI FLASH and www.fbi.gov/facestealer may have them).","fix":"Never install software or run commands someone gives you during a call to fix audio or video; leave and rejoin from the official app or website. Before a call, confirm the invite with the contact over a different channel. Maintainers: turn on hardware-key 2FA for GitHub, npm and PyPI, and require reviews/signing for releases. If someone was infected: wipe or isolate the machine, move crypto to new wallets from a clean device, rotate all passwords, tokens and repository/publishing keys, end sessions on chat and social accounts, warn your contacts, and report to the FBI at ic3.gov.","status":"open","published_at":null,"first_seen_at":"2026-11-13T15:03:57+00:00","triaged_at":"2026-11-13T15:03:57+00:00","updated_at":"2026-11-13T15:04:17+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-13T15:08:57Z","path":"tampered-install","entry":"social-engineering","reason":"Targets are tricked by a fake call with a link or prompt to 'fix' audio, which the victim runs to install malware, and the FBI says a maintainer's computer was used to add malicious code to widely used software, though it was caught before it spread far.","confidence":0.6}},"analyst_status":"done","analyst_note":null,"search":"'-202611':37A '12':186B '18':171B '2026':188B '400m':34A,165B '900':181B 'account':70B,208B,248B 'add':227B 'ai':109B 'also':143B 'announc':185B 'apt38':58B 'attack':216B 'audio':29A 'bluenoroff':57B 'call':18A 'campaign':47B 'caught':237B 'chain':215B 'chollima':60B 'cloud':178B 'cmp':36A 'code':229B 'come':78B 'comput':223B 'contact':107B 'crypto':6A,115B,167B,193B 'deepfak':110B 'develop':11A,203B 'doj':159B 'earli':49B 'earlier':73B 'early-warn':48B 'facesteal':1A 'fake':13A,28A,120B 'far':241B 'fbi':33A,157B,175B,218B 'figur':116B 'fix':30A,137B 'github':45A 'googl':96B 'google':42A 'hacker':4A,53B,118B,210B 'happen':251B 'hear':128B 'hijack':249B 'impost':89B 'infect':260B 'infrastructur':179B 'instal':31A,140B 'invit':5A,64B,77B 'iqiske':38A 'know':25A,83B 'known':114B 'korean':3A,52B 'last':170B 'link':133B 'maintain':205B,221B 'malici':228B 'malwar':32A,141B 'media':67B 'meet':17A,43A,63B,85B,97B 'messag':69B 'microsoft':40A,93B 'month':172B,252B 'new':146B 'next':154B 'north':2A,51B 'nov':187B 'npm':46A 'one':220B 'open':9A,201B 'open-sourc':8A,200B 'peopl':23A,191B 'play':99B 'prerecord':100B 'problem':123B 'project':243B 'prompt':135B 'record':20A,144B 'repositori':207B 'run':86B 'sapphir':54B 'say':160B,219B 'seiz':176B 'send':61B,131B 'sleet':55B 'social':66B 'softwar':233B 'someon':80B 'sourc':10A,202B 'spread':240B 'stardust':59B 'stole':162B 'stolen':35A,71B 'suppli':214B 'supply-chain':213B 'target':82B,105B,155B,189B 'team':15A,94B 'teams':41A 'technic':122B 'telegram':44A 'theft':246B 'unc1069':56B 'unknown':245B 'use':151B,225B,232B 'usual':124B 'version':90B 'victim':74B,147B,182B 'video':21A,62B,102B,184B 'want':211B 'warn':50B 'web3':195B 'webcam':101B,149B,183B 'well':113B 'well-known':112B 'whose':206B 'wide':231B 'year':257B 'zoom':14A,39A,92B","nicknames":["FaceStealer","Sapphire Sleet","UNC1069","BlueNoroff","APT38","Stardust Chollima","Dangerous Password","CryptoCore"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["apt38","bluenoroff","cryptocore","dangerouspassword","facestealer","github","googlemeet","meet","microsoftteams","npm","sapphiresleet","stardustchollima","teams","telegram","unc1069","zoom"],"ptokens":["github","google","meet","microsoft","npm","teams","telegram","zoom"],"labels":["campaign","earlywarning","high","other"],"campaign_type":"phishing","search_a":"'-202611':37A '400m':34A 'audio':29A 'call':18A 'cmp':36A 'crypto':6A 'develop':11A 'facesteal':1A 'fake':13A,28A 'fbi':33A 'fix':30A 'github':45A 'google':42A 'hacker':4A 'instal':31A 'invit':5A 'iqiske':38A 'know':25A 'korean':3A 'malwar':32A 'meet':17A,43A 'microsoft':40A 'north':2A 'npm':46A 'open':9A 'open-sourc':8A 'peopl':23A 'record':20A 'sourc':10A 'stolen':35A 'team':15A 'teams':41A 'telegram':44A 'video':21A 'zoom':14A,39A","search_b":"'12':186B '18':171B '2026':188B '400m':165B '900':181B 'account':70B,208B,248B 'add':227B 'ai':109B 'also':143B 'announc':185B 'apt38':58B 'attack':216B 'bluenoroff':57B 'campaign':47B 'caught':237B 'chain':215B 'chollima':60B 'cloud':178B 'code':229B 'come':78B 'comput':223B 'contact':107B 'crypto':115B,167B,193B 'deepfak':110B 'develop':203B 'doj':159B 'earli':49B 'earlier':73B 'early-warn':48B 'fake':120B 'far':241B 'fbi':157B,175B,218B 'figur':116B 'fix':137B 'googl':96B 'hacker':53B,118B,210B 'happen':251B 'hear':128B 'hijack':249B 'impost':89B 'infect':260B 'infrastructur':179B 'instal':140B 'invit':64B,77B 'know':83B 'known':114B 'korean':52B 'last':170B 'link':133B 'maintain':205B,221B 'malici':228B 'malwar':141B 'media':67B 'meet':63B,85B,97B 'messag':69B 'microsoft':93B 'month':172B,252B 'new':146B 'next':154B 'north':51B 'nov':187B 'one':220B 'open':201B 'open-sourc':200B 'peopl':191B 'play':99B 'prerecord':100B 'problem':123B 'project':243B 'prompt':135B 'record':144B 'repositori':207B 'run':86B 'sapphir':54B 'say':160B,219B 'seiz':176B 'send':61B,131B 'sleet':55B 'social':66B 'softwar':233B 'someon':80B 'sourc':202B 'spread':240B 'stardust':59B 'stole':162B 'stolen':71B 'suppli':214B 'supply-chain':213B 'target':82B,105B,155B,189B 'team':94B 'technic':122B 'theft':246B 'unc1069':56B 'unknown':245B 'use':151B,225B,232B 'usual':124B 'version':90B 'victim':74B,147B,182B 'video':62B,102B,184B 'want':211B 'warn':50B 'web3':195B 'webcam':101B,149B,183B 'well':113B 'well-known':112B 'whose':206B 'wide':231B 'year':257B 'zoom':92B","search_c":"","cause_entry":"social-engineering","cause_path":"tampered-install","disclosures_checked_at":null,"first_public_at":"2026-11-12T21:20:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-iqiske","url":"https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-13T15:03:57+00:00","fetched_at":"2026-11-13T15:03:57+00:00","note":null,"cites":["https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency","https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme"]}],"documents":[{"id":146777,"url":"https://x.com/TheHackersNews/status/2121249678167806415","title":"@TheHackersNews: 🛑 North Korean hackers stole over $400 MILLION in crypto using fake video calls ","kind":"post","source":"x","publisher":null,"text":"🛑 North Korean hackers stole over $400 MILLION in crypto using fake video calls and deepfakes, FBI says.\n\nThe scheme used stolen accounts, familiar faces, and fake audio errors to trick victims into installing malware.\n\nThe FBI has now seized the attack infrastructure.\n\nHow it https://t.co/MT4gxsekzZ\n\nlikes 29 reposts 9","published_at":"2026-11-13T14:31:48+00:00","relation":"describes","confidence":null,"note":null},{"id":146937,"url":"https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency","title":"Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency","kind":"advisory","source":"analyst","publisher":null,"text":"DOJ/FBI seized cloud infrastructure of the North Korean FaceStealer scheme (Sapphire Sleet, UNC1069, BlueNoroff, APT38, Stardust Chollima): invitations to video meetings from accounts stolen from earlier victims, imposter Zoom/Teams/Meet, prerecorded webcam video of known contacts and deepfakes, fake audio error with a link or prompt to fix it that installs malware. Over $400M stolen in 18 months, 900+ victim webcam videos seized. Increasingly targets open-source developers and maintainers for repository access. Compromise can be exploited months to over a year later.","published_at":"2026-11-12T21:20:09+00:00","relation":"describes","confidence":null,"note":null},{"id":146938,"url":"https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme","title":"FaceStealer Cryptocurrency Theft Scheme — FBI","kind":"advisory","source":"analyst","publisher":null,"text":"FBI page: FaceStealer uses imposter versions of popular video conferencing platforms, secretly recorded webcam video and intrusions. Attributed to Sapphire Sleet, UNC1069, Stardust Chollima, APT38, BlueNoroff. Increasingly targets open-source developers and maintainers to compromise the software supply chain. Lifecycle: record victim webcam; hijack victim's communication accounts and message contacts; send fake video link; imposter video chat; impersonate with recorded video and trick target to self-infect.","published_at":"2026-11-13T02:49:58+00:00","relation":"describes","confidence":null,"note":null},{"id":140071,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3n25kvz4yjs2l","title":"@campuscodi.risky.biz: US disrupts North Korea's FaceStealer cyber operation\n\nThis is a Bluenoroff APT ","kind":"post","source":"bluesky","publisher":null,"text":"US disrupts North Korea's FaceStealer cyber operation\n\nThis is a Bluenoroff APT op targeting crypto devs\n\nwww.justice.gov/opa/pr/justi...\n\nwww.ic3.gov/CSA/2026/261...\nhttps://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency https://www.ic3.gov/CSA/2026/261112.pdf\n\nlikes 0 reposts 0","published_at":"2026-11-12T22:56:14+00:00","relation":"discussion","confidence":null,"note":"@campuscodi.risky.biz"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}