A message arrives from a colleague on Telegram, then a Calendly invitation to a Zoom or Teams call about an investment. On the call, familiar faces appear in the video grid, an audio error interrupts, and a quick fix is offered for pasting into the machine. According to the FBI, that sequence drained more than $400 million in cryptocurrency over 18 months.
Read next on Morning Overview: A $1 billion gas plant planned for Superior, Wisconsin, has been abandoned
The FBI calls the scheme FaceStealer and ties it to North Korea. In announcements dated Nov. 12, the FBI and the Justice Department said they had taken over the cloud infrastructure behind it, and the Justice Department separately announced a court-authorized seizure and restraint of more than $1.2 billion in crypto stolen in the Binance hack.
How a stolen account becomes a fake meeting
The FBI’s description of FaceStealer, summarized by The Hacker News, starts with a compromise. Operators harvest wallets and seed phrases, hijack a Telegram or other messaging account, read the contacts and chat history, and quietly record video calls. They then message the victim’s contacts as the victim, proposing a meeting about an investment, and follow up with a Calendly invite and a typosquatted Zoom or Teams link.
The call itself is theater. Recorded webcam footage of trusted contacts plays to suggest a crowded meeting, with ChatGPT-generated headshots standing in as avatars. Reporting by The Record adds that some attacks used AI deepfakes of prominent crypto figures, so the fakery runs from replayed recordings to synthetic faces rather than one single technique.
When the target reports an audio or SDK error, the attackers push a ClickFix-style remedy such as a link, script or terminal command. According to the Justice Department and FBI account relayed by The Record, that fix installs a browser cookie harvester, keyloggers, a screen capturer and a backdoor, and the new victim’s accounts become the launch point for the next round of messages, sometimes months later.
Two details of the lure explain why it works on professionals who know better. The meeting invitation arrives through Calendly, a tool most business contacts already use, and it comes from an account the attackers previously stole, so the sender really is someone the target knows. The domain on the meeting link is a lookalike of Zoom or Microsoft Teams, and per the FBI account the malware can land before the target even joins the call.
The security firm JUMPSEC, cited in the same reporting, describes a phishing kit that imitates Zoom and Teams and spreads through Telegram. That matches the FBI picture of a chain that moves from one hijacked account to the next, with each victim’s contact list serving as the target list for the following wave.
The $400 million figure and who stands behind it
Brett Leatherman, the FBI’s Cyber Branch Operations Director, said North Korea relies on cryptocurrency theft to fund its weapons program and that FaceStealer alone caused more than $400 million in losses across 18 months. The bureau’s own FaceStealer page and the Justice Department announcement carry the government’s case, and a joint advisory posted to the Internet Crime Complaint Center sets out the technical indicators.
The FBI attributed the activity to BlueNoroff, the cluster also tracked as APT38, UNC1069 and Sapphire Sleet. Patrick Grandy, an FBI official quoted by The Record, warned that FaceStealer exploits trust in video conferencing platforms, which is what makes a familiar face on a screen so persuasive.
Victims, targets and the seized webcam archive
Investigators obtained a warrant covering more than 900 webcam recordings of victims, footage the operators were using to impersonate people in follow-on attacks. FBI officials told The Record they had interviewed many victims but could not identify the first one, and an agent said it is unclear whether FaceStealer played any part in the Binance breach.
Private researchers had been tracking the campaign for months. In April 2026, Arctic Wolf documented more than 400 victims in over 20 countries, concentrated in the U.S., Singapore, the U.K., Hong Kong, South Korea and the U.A.E. A later update from the same firm counted 677 targets in 58 countries, with more than 80 percent of them founders or C-suite executives.
Developers are in the crosshairs too. The FBI said it is aware of North Korean attempts to target software developers, maintainers and high-download libraries, and The Record notes attempts against maintainers on NPM and Rust crate repositories. The maintainer of the Axios npm package was targeted with FaceStealer to push a trojanized release carrying a cross-platform remote access tool.
A related but separate cluster of North Korean activity, tracked as Contagious Interview, uses fake recruiters instead of fake investors. A joint advisory from Japan, the U.S., Australia and Germany in late September estimated at least 30,000 compromised devices across 100 countries, with malicious coding tests, VS Code configuration files and git hooks as delivery routes. FaceStealer overlaps in method, since both lean on a plausible human pretext and a fix the target runs personally.
The $1.2 billion Binance seizure and what remains open
The larger dollar figure comes from a different case. Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said multiple department components helped freeze billions in stolen assets, and the court-authorized action covers more than $1.2 billion taken from Binance by TraderTraitor, part of $2.7 billion frozen across several platforms. The department said tracing, freezing and forfeiture continue because the group keeps laundering through bridges, mixers and exchanges.
Elliptic reported that launderers created their own worthless tokens and routed stolen assets through decentralized exchange liquidity pools, a technique North Korea also used after the Bybit hack in 2025. The open question for investigators is scale: with 900 recordings in hand and no identified first victim, the count of people whose faces were reused in later calls is still unknown.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Zero Motorcycles unveiled an electric motorcycle targeted at under $8K and a street-legal dirt bike at EICMA
- New FCC rules on how people can stop robocalls and texts take effect Nov. 25
- Neanderthals in Spain carved a wooden object that matches nothing archaeologists have ever found
- The FAA wants $2.39 million from a flight school it says flew a Cessna about 280 times with an unapproved part
