The FaceStealer campaign, a North Korea-linked operation that used fake video meetings to deliver malware, has been disrupted by US authorities. The Department of Justice announced the action on 12 November 2026, alongside separate legal measures targeting cryptocurrency stolen from Binance.
The FBI and Department of Justice seized cloud infrastructure supporting FaceStealer, including more than 900 webcam recordings taken from victims. Officials assess that the campaign enabled at least $400 million in cryptocurrency theft over the preceding 18 months.
How the FaceStealer campaign was disrupted
The operation targeted infrastructure used to impersonate trusted contacts, host fraudulent meeting pages, record victims and distribute malware. It was led by the FBI’s Los Angeles Field Office and prosecutors from the Central District of California.
The FaceStealer campaign is attributed to North Korea-linked activity clusters tracked under several private sector names. These include Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff and Stardust Chollima.
Authorities seized cloud-based systems used in the scheme and recovered more than 900 victim webcam videos. These recordings were not merely evidence of previous compromises. The attackers could reuse them to impersonate victims during later calls with colleagues, friends and professional contacts.
The operation was active and financially successful before the disruption. According to the FBI, FaceStealer generated at least $400 million in stolen cryptocurrency during an 18-month period from around May 2025 to November 2026.
No public FaceStealer-specific domains, file hashes or other technical indicators had been released at the time of writing. The FBI’s public material instead focuses on the campaign’s tradecraft, attribution and recognisable social engineering techniques.
How fake video meetings delivered malware
The FaceStealer campaign did not exploit a disclosed vulnerability in legitimate conferencing software. Instead, it relied on hijacked accounts, convincing messages and impostor pages designed to resemble Zoom, Microsoft Teams or Google Meet.
Invitations from compromised accounts
Attackers approached targets through previously hijacked Telegram, LinkedIn, Slack and Discord accounts. Because messages came from a familiar identity, the actors could refer to earlier conversations or existing professional relationships to make an invitation appear credible.
Calendar invitations and direct messages contained typo-squatted meeting links. These sent the recipient to a page controlled by the attackers rather than the genuine video conferencing service.
Recorded contacts and AI-generated impersonation
Once the target joined, the fraudulent page displayed prerecorded video of somebody they knew. In other cases, the operators used AI-generated deepfakes of prominent cryptocurrency or Web3 figures.
The meeting then appeared to develop an audio problem, such as the target being told that their microphone could not be heard. The supposed solution required the victim to run a script, paste commands into a terminal or complete another action that installed malware.
This malware could establish persistence and steal credentials, data and access to cryptocurrency assets. At the same time, the fraudulent meeting page recorded the new victim’s webcam, giving the actors fresh material for subsequent impersonation attempts.
Delayed theft and movement to new targets
The attackers did not always empty accessible cryptocurrency accounts immediately. In some cases, theft or account hijacking occurred months, or more than a year, after the initial compromise, potentially allowing wallet balances and the value of available access to increase.
After compromising a victim, the operators searched messaging accounts, social media profiles and contact lists for further targets. The cycle allowed the FaceStealer campaign to expand through existing networks of trust rather than relying solely on unsolicited approaches.
The main stages of the operation were:
- Hijack a communication account belonging to an earlier victim.
- Invite a trusted contact to a fraudulent video meeting page.
- Display recorded or AI-generated footage of a familiar person.
- Simulate a technical problem and provide a malicious fix.
- Install malware, steal access and record the victim’s webcam.
- Reuse compromised accounts and video recordings in later attacks.
Open-source developers face supply chain risk
Cryptocurrency and Web3 personnel were central targets, but the FBI reports that FaceStealer actors increasingly approached open-source software developers and maintainers. This broadening of the target set raises the prospect of compromises extending beyond an individual wallet or account.
Access to a maintainer’s development environment, source code repository or publishing credentials could potentially be used to alter software consumed by many downstream organisations. No specific open-source package compromise was confirmed in the public announcement, but the targeting pattern indicates an apparent supply chain objective.
The risk is particularly significant because the FaceStealer campaign attacks trusted relationships rather than a particular product version. Public materials do not specify affected operating systems or software versions, and Zoom, Teams and Meet were imitated rather than reported as vulnerable.
Separate action targets funds from Binance theft
The Department of Justice announcement also covered a parallel legal action concerning the separate Binance cryptocurrency theft on 29 October 2026. The FBI attributed that incident to North Korean military activity tracked as TraderTraitor.
On 31 October 2026, the FBI publicly attributed the Binance theft and published blockchain addresses associated with laundering the stolen assets. The incident involved more than $6 billion in virtual assets, although reported totals vary and may change as freezes and recoveries develop.
The Department of Justice subsequently obtained court authorisation to seize or restrain more than $1.2 billion within funds frozen following the theft. This wording is important. The order does not mean the entire $1.2 billion had already been recovered or finally forfeited to the US government.
Combined efforts had frozen more than $2.7 billion connected with the related fund tracing. Cryptocurrency businesses and virtual asset service providers have been urged to review the FBI’s published TraderTraitor addresses and block associated transactions where appropriate.
FaceStealer campaign timeline and current status
- Around May 2025 to November 2026: FaceStealer enables at least $400 million in cryptocurrency theft over 18 months.
- 29 October 2026: The separate Binance cryptocurrency theft takes place.
- 31 October 2026: The FBI attributes the Binance incident to TraderTraitor and publishes laundering addresses.
- 12 November 2026: The Department of Justice announces the FaceStealer infrastructure seizure and the Binance-related court authorisation.
- 12 November 2026: The FBI publishes its FaceStealer resource and an IC3 FLASH describing the campaign’s techniques.
The infrastructure seizure has disrupted a proven campaign, but it does not establish that every operator, malware installation or compromised account has been removed. Organisations should therefore treat similar fake meeting approaches as an active threat pattern.
What organisations should do now
Organisations involved in cryptocurrency, Web3 or open-source development should verify unexpected meeting invitations through a separate communication channel. Staff should never run scripts or terminal commands presented as a conferencing audio fix.
Teams should also review logins to messaging, developer and repository accounts, prioritising unusual sessions and newly created access tokens. Multi-factor authentication can reduce account takeover risk, although organisations should also protect recovery methods and remove unauthorised sessions.
Where a suspicious FaceStealer meeting has occurred, affected systems should be isolated and examined for malware, stolen credentials and persistence. Cryptocurrency operators should separately check current FBI-published TraderTraitor blockchain indicators connected with the Binance theft.
Originally reported by thecyberexpress.com.
