--- id: "CMP-202611-iqiske" page: "https://infrastack.ai/live/CMP-202611-iqiske" kind: "campaign" aliases: [] title: "FaceStealer: North Korean hackers invite crypto and open-source developers to fake Zoom, Teams or Meet calls with recorded video of people they know, then a fake audio 'fix' installs malware (FBI, $400M+ stolen)" severity: "high" cvss: null epss: null exploited: true status: "open" category: "other" products: [{"name": "Zoom", "fixed": []}, {"name": "Microsoft Teams", "fixed": []}, {"name": "Google Meet", "fixed": []}, {"name": "Telegram", "fixed": []}, {"name": "GitHub", "fixed": []}, {"name": "npm", "fixed": []}] ecosystems: [] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-13T15:03:57+00:00" updated_at: "2026-11-13T15:04:17+00:00" sources: [{"source": "analyst", "url": "https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency", "first_seen_at": "2026-11-13T15:03:57+00:00", "cites": ["https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency", "https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme"]}] exploit_sources: [] --- # FaceStealer: North Korean hackers invite crypto and open-source developers to fake Zoom, Teams or Meet calls with recorded video of people they know, then a fake audio 'fix' installs malware (FBI, $400M+ stolen) Link for people: https://infrastack.ai/live/CMP-202611-iqiske (this .md is for agents) North Korean hackers (Sapphire Sleet / UNC1069 / BlueNoroff / APT38 / Stardust Chollima) send video meeting invitations from social media and messaging accounts stolen from earlier victims, so the invite comes from someone the target knows. The meeting runs on an imposter version of Zoom, Microsoft Teams or Google Meet and plays prerecorded webcam video of the target's contacts or AI deepfakes of well-known crypto figures. The hackers then fake a technical problem (usually 'we can't hear you') and send a link or prompt to 'fix' it, which installs malware. They also record the new victim's webcam to use against the next target. The FBI and DOJ say it stole more than $400M in crypto over the last 18 months, and the FBI seized the cloud infrastructure and 900+ victim webcam videos (announced 12 Nov 2026). Targets are people in crypto and Web3, and more and more open-source developers and maintainers, whose repository accounts the hackers want for supply-chain attacks. The FBI says one maintainer's computer was used to add malicious code to widely used software, and it was caught before it spread far; which project is unknown. Theft and account hijacking can happen months to more than a year after the infection. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Zoom affected range not listed fixed no fixed version listed - :Microsoft Teams affected range not listed fixed no fixed version listed - :Google Meet affected range not listed fixed no fixed version listed - :Telegram affected range not listed fixed no fixed version listed - :GitHub affected range not listed fixed no fixed version listed - :npm affected range not listed fixed no fixed version listed ## Cause How the attacker got in: a person was tricked (social-engineering). Targets are tricked by a fake call with a link or prompt to 'fix' audio, which the victim runs to install malware, and the FBI says a maintainer's computer was used to add malicious code to widely used software, though it was caught before it spread far. How it reached others: their users installed or auto-updated it (tampered-install). So it does not happen to you: Use phishing-resistant second factors on the accounts that matter, and never reset a factor on a phone call alone. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#tampered-install ## How to check A video call invitation, often over Telegram, X, LinkedIn or another chat app, from a contact you know that leads to a meeting link not on the real zoom.us, teams.microsoft.com or meet.google.com domains; during the call an 'audio not working' or 'can't hear you' error with a link, download, SDK/driver update or Terminal/PowerShell command to fix it. If anyone on the team ran such a fix, treat the machine as compromised, even if it was months ago. The FBI has not published domains or file hashes in the sources we read (the FBI FLASH and www.fbi.gov/facestealer may have them). ## Fix Never install software or run commands someone gives you during a call to fix audio or video; leave and rejoin from the official app or website. Before a call, confirm the invite with the contact over a different channel. Maintainers: turn on hardware-key 2FA for GitHub, npm and PyPI, and require reviews/signing for releases. If someone was infected: wipe or isolate the machine, move crypto to new wallets from a clean device, rotate all passwords, tokens and repository/publishing keys, end sessions on chat and social accounts, warn your contacts, and report to the FBI at ic3.gov. ## Timeline - 2026-11-13T15:03:57+00:00 analyst https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency ## Documents - [describes] @TheHackersNews: 🛑 North Korean hackers stole over $400 MILLION in crypto using fake video calls https://x.com/TheHackersNews/status/2121249678167806415 - [describes] Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency - [describes] FaceStealer Cryptocurrency Theft Scheme — FBI https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme - [discussion] @campuscodi.risky.biz: US disrupts North Korea's FaceStealer cyber operation This is a Bluenoroff APT https://bsky.app/profile/campuscodi.risky.biz/post/3n25kvz4yjs2l --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_