The FBI calls it FaceStealer, and the name is the whole trick: the face on your video call is real footage of someone you trust. In November 2026, the FBI and the Department of Justice announced they had disrupted the cloud infrastructure behind the scheme, which the FBI attributes to North Korean cyber actors. Investigators seized more than 900 secretly recorded webcam videos of victims working in cryptocurrency and Web3 around the world. Before the disruption, the operation had stolen more than $400 million in roughly 18 months.
For any business that takes video calls, pays invoices, or trusts an email from a known contact, the lesson is uncomfortable. A familiar face and voice are no longer proof of identity, because they are no longer proof of presence.
How the FaceStealer Scheme Works
The FBI's write-up lays out a clean five-step lifecycle:
- The attackers compromise a victim and secretly record their webcam.
- They hijack that victim's communication accounts and start messaging the victim's own contacts.
- Using the compromised account, they send a convincing fake video meeting link to a new target.
- The target joins what looks like a routine video call with someone they know.
- The attackers impersonate the original victim using the recorded webcam footage and talk the target into infecting their own device.
The disturbing part is step five. This is not a deepfake generated on the fly. It is real recording of a real person, played back to people who have worked with them. The target sees a familiar face, hears about a deal or a problem, and is asked to install a tool, run a fix, or approve access. Many people who would spot a phishing email will not question a colleague's face on screen.
Who Is Behind It
The FBI attributes the activity to North Korean state-sponsored attackers tracked in the private sector under several names: Sapphire Sleet, UNC1069, Stardust Chollima, APT38, and BlueNoroff. These groups have stolen billions of dollars in cryptocurrency in recent years, and their tactics keep shifting to stay ahead of defensive controls.
Why This Matters Beyond Cryptocurrency
Crypto firms are the primary target because the payoff is instant and hard to reverse, but the FBI notes a shift that should worry every business: these actors increasingly target open-source software developers and maintainers to reach the software supply chain. By compromising the accounts of trusted maintainers, they can push malicious code into software used widely downstream, potentially affecting millions of users.
That makes this a supply chain problem, not just a cryptocurrency problem. Small businesses rarely build the software they run, but they depend on the people who maintain it, and they trust the brands that ship it. A compromise three steps up the chain arrives looking completely legitimate.
Watch: The FBI Explains FaceStealer
The FBI's Los Angeles field office released a short briefing on the scheme. It is worth two minutes, and it is a good clip to share with a team.
Click the image to watch. Video: "FaceStealer Cryptocurrency Theft Scheme," FBI Los Angeles Special Agent in Charge of Cyber and Counterintelligence Jeremy Robertson. Source: FBI, official YouTube channel.
How to Protect Your Business
- Verify out of band. If a call, email, or message asks you to do something sensitive, confirm it using a phone number or channel you already had, not the one in the request.
- Stop treating video as verification. A face on screen now proves someone recorded that face, not that the person is present. Require a second factor for money movement and access changes.
- Never install or "update" anything at the request of someone on a call. Legitimate vendors do not walk you through a download mid-meeting.
- Use phishing-resistant sign-in. Hardware security keys or passkeys protect accounts even after a password is stolen.
- Audit account access. Check active sessions, connected third-party apps, mail forwarding rules, and MFA methods, since account takeover is step two of the attack.
- Cover the camera. A physical shutter or a taped lens defeats the recording stage entirely.
- Train for the scenario, not just the phish. Run an exercise where a "known" colleague asks for something unusual on a video call and see who verifies it.
If You Think You Have Been Targeted
Report it to the FBI at ic3.gov, contact your bank and, if relevant, your crypto exchange immediately, and preserve the device rather than wiping it. Tell your IT provider early, since stolen session tokens and mail rules are often the real damage. Time matters more than tidiness.
Sources
- FBI, FaceStealer Cryptocurrency Theft Scheme: https://www.fbi.gov/investigate/cyber/facestealer-cryptocurrency-theft-scheme
- FBI and DOJ announcement on disrupting North Korea's cryptocurrency theft infrastructure, November 2026: https://www.fbi.gov/news/press-releases/justice-department-announces-actions-to-disrupt-north-koreas-massive-theft-of-cryptocurrency
- FBI FLASH advisory, November 12, 2026: https://www.ic3.gov/CSA/2026/261112.pdf
- FBI video briefing on FaceStealer: https://www.youtube.com/watch?v=T12B5YlB8Ws
Need Help Tightening Your Defenses?
At Prosen Consulting, we support businesses throughout Northeast Ohio, including Lake, Geauga, Ashtabula, and Cuyahoga counties, with identity protection, email security, endpoint management, and practical security training that covers schemes like this one. If your team takes video calls from clients, vendors, or partners, we can help you put verification steps in place before someone asks for something urgent. Call us at 216-867-0692.