US authorities seized infrastructure and more than 900 victim recordings used in attacks targeting cryptocurrency holders and software maintainers
North Korean hackers stole victims' webcam footage to impersonate trusted contacts in malware attacks, the FBI warned on 12 November 2026 as US authorities seized infrastructure used in FaceStealer.
The FBI seized more than 900 victim webcam recordings. It attributes more than $400 million (approximately £302 million) in cryptocurrency theft over 18 months to the operation, which also targeted people maintaining widely used software.
FaceStealer Turns Stolen Accounts Into New Invitations
The FBI's warning extends from stolen cryptocurrency to hijacked professional relationships and access to software distribution. Attackers use compromised accounts and recorded faces to approach further targets, including developers whose accounts control code downloaded by others.
'It exploits our trust in ubiquitous video conference platforms and valued personal relationships,' said Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office.
Invitations arrive through genuine accounts taken from previous victims, including Telegram, LinkedIn, Slack and Discord. Attackers can read earlier conversations and tailor their messages before directing contacts to imitation Zoom or Microsoft Teams meetings.
Inside the meeting, recordings make familiar people appear present. Attackers then claim there is an audio problem and supply a purported fix, such as an update, script or command that installs malware.
FaceStealer Still Relies Mainly on Genuine Webcam Recordings
The FBI says attackers have begun generating deepfake videos of influential cryptocurrency figures. However, the scheme still overwhelmingly relies on genuine recordings stolen from earlier victims, rather than AI-generated video.
The malware can record keystrokes, capture screenshots and steal browser cookies that preserve signed-in sessions, while providing continuing device access. In several cases, attackers waited months or more than a year before stealing cryptocurrency as wallet balances increased.
Martin Kuchař, co-founder and chief executive of the BTC Prague conference, previously wrote on LinkedIn: 'I have been personally affected via a compromised Telegram account.' He described impersonated contacts and requests to install a plugin to resolve audio problems.
His warning predates the announcement. The reviewed evidence does not establish whether he appears among the FBI's identified victims.
JavaScript Maintainer Attack Reached Software Dependencies
The FBI described an attack in which a maintainer of a major open-source JavaScript library followed troubleshooting instructions during a fake Teams meeting, infecting his computer. Attackers used his access to create malicious dependencies, additional software intended to accompany legitimate library downloads.
The bureau said quick detection and response prevented potentially extensive harm. It also reported other attempts against maintainers publishing JavaScript packages and Rust software components.
FBI Advises Verifying Meetings Through Another Channel
If a familiar face appears on screen, the FBI recommends checking the invitation through another communication method. Readers should join through official meeting applications using invite codes and avoid running scripts or terminal commands supplied as technical fixes.
The bureau also advises delaying webcam activation until participants can see, hear and communicate with the inviter. Anyone suspecting compromise should change passwords, end active sessions, enable multifactor authentication and warn contacts and employers about possible impersonation.
As with other impersonation scams, recognising the supposed sender does not verify who controls the account. The FBI's precautions address instructions delivered during an apparently routine work conversation.
