FBI warns of FaceStealer fake video calls

A familiar face in a fraudulent meeting

The FBI issued a FaceStealer warning on 12 November 2026 for people working in cryptocurrency and Web3 and for open-source software maintainers. The bureau says attackers use hijacked messaging accounts and recorded webcam footage to make fraudulent video meetings look like conversations with trusted contacts.

According to the advisory, the FBI identified and seized more than 900 victim webcam recordings. It attributes the campaign to North Korean state-sponsored actors and estimates cryptocurrency theft exceeding $400 million over 18 months. Those figures and the attribution are the bureau’s findings; they are not an announcement of compensation or returned funds. [1]

The supposed repair installs malware

An invitation can arrive from a real account belonging to someone the recipient knows. During the fake meeting, attackers play previously recorded footage and claim that an audio problem or another technical fault needs fixing. The proposed update or repair causes the participant to install malware.

The FBI says the campaign still relies predominantly on genuine stolen recordings, although attackers also use deepfakes. Recognizing a face therefore does not authenticate the meeting. The compromised device can expose cryptocurrency, communication accounts and the victim’s contacts, providing material for further invitations.

The advisory describes cases in which theft followed months or more than a year after the initial compromise. An unchanged wallet balance immediately after a suspicious call is therefore not a reliable indication that the device and its secrets remain secure. [2]

Developers are also targets

The warning also covers attempts to obtain developers’ devices and software-repository access. The FBI describes a maintainer compromise involving a JavaScript library in which a rapid response stopped a wider supply-chain attack. It does not name that library in the advisory.

Earlier research published by Microsoft in April 2026, with a June update, documents Sapphire Sleet activity targeting macOS users through counterfeit updates and user-initiated execution. This provides technical context for the social-engineering mechanism; it does not independently establish the FBI’s total loss estimate. [2][3]

What the FBI recommends

The FBI advises joining through the official meeting application with an invitation code and confirming unexpected meetings through a different communication channel. Participants should not run scripts or paste commands into a terminal to resolve a problem presented during a call.

After suspected compromise, its recommendations include securing sensitive accounts, ending active sessions, enabling multifactor authentication and warning contacts and employers. The bureau asks people reporting the incident through IC3 to include the keyword FaceStealer. Account recovery and device remediation remain necessary even when malicious infrastructure has been disrupted. [4]