FaceStealer: Fake Video Conferences and Recorded Footage Used to Induce Self-Infection and Steal Cryptocurrency and Developer Accounts

1. Basic Information

• Article Name: North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M “FaceStealer” Crypto Theft Scheme
• Published By: FBI
• Publication Date: 2026-11-12
• Source: FBI FLASH AC-111226-MS
• Related Sources: FBI Special Page, US Department of Justice, Arctic Wolf, BleepingComputer
• Related Malware: Cookie harvesters, keyloggers, screen capture tools, and backdoors used in the FaceStealer campaign (specific names not identified in public disclosures)
• Related Threat Actors: State-sponsored actors from North Korea (also tracked as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima)
• Related CVEs: None specified
• Related Products: Zoom, Microsoft Teams, Telegram, LinkedIn, Slack, Discord, cryptocurrency wallets, npm, and the Rust package ecosystem
• Response Priority (Author Assessment): Critical

2. Executive Summary

State-sponsored actors from North Korea reused compromised accounts and secretly recorded webcam footage of victims in fake video conferences to trick participants into running commands that stole cookies, credentials, and cryptocurrency. The FBI reported that more than $400 million had been stolen over the preceding 18 months and that it had seized more than 900 webcam recordings, though the number of recordings cannot be equated with the number of independently verified victims.

3. Attack Flow

From Trust Hijacking to Cryptocurrency Theft and Re-propagation

1. Steal wallets, seed phrases, contact histories, and webcam footage from existing victim devices and accounts.
2. Send meeting invitations to known contacts from compromised Telegram, LinkedIn, Slack, or Discord accounts, guiding them to typosquat URLs mimicking legitimate services just before the meeting.
3. Play previously recorded footage or, in some cases, deepfake videos in the fake conference interface, prompting users to run scripts, download files, or execute terminal commands to "fix" audio or connection issues.
4. Deploy payloads via the executed actions to steal browser cookies, keystrokes, screens, and credentials, and install a backdoor.
5. Seize cryptocurrency and communication accounts, then reuse the newly acquired contacts and recorded footage for subsequent attacks.

The following are separate incidents or attempts using the same techniques and do not necessarily follow the flow above:

• JavaScript Library Maintainer Incident: Following device infection, an attempt was made to create malicious dependencies by abusing the maintainer's access. Early detection and response prevented widespread supply chain impact.
• Other Independent Attempts: The FBI is also aware of other attempts targeting maintainers with npm repositories or Rust crates. Whether these attempts successfully achieved compromise has not been indicated.

4. Attacker Position and Execution Location

• Attackers use compromised communication accounts and legitimate calendar services as the starting point of trust.
• Initial payloads are executed on the victim's device after the victim follows instructions in the fake conference interface. Afterward, the payloads access browser sessions, cryptocurrency wallets, and developer accounts.

5. Victim and Administrator Perspective

Victims

• The invitation appears as a standard meeting invite from a known individual, followed by reported camera and audio issues upon joining.
• The video of meeting participants may be recorded or generated, meaning the individual may not be participating in real time.

Administrators

• Inference: When communication histories and device or account audit logs are available, investigations focus on typosquat URLs sent from communication accounts immediately prior to scheduled meetings, shell or terminal execution outside the browser, access to cookie stores, screen and camera captures, and new account sessions or recovery information changes.

6. Success and Failure Conditions

Success Conditions

• Targets trust the invitation due to compromised accounts or reused footage and access the fake conference URL.
• Targets execute the provided scripts or commands, establishing access to endpoints, browsers, wallets, and developer accounts.

Failure Conditions and Countermeasures

• Confirming meeting invitations with senders through alternative channels and using only official clients and legitimate invite codes prevents redirection to fake conferences.
• Operational practices prohibiting scripts, terminal commands, or browser extensions during meetings, along with application allowlisting, EDR, session revocation, and credential rotation, mitigate follow-on compromises.

7. What Happens Upon Success

• Theft of browser cookies, credentials, seed phrases, wallet assets, and screen or webcam footage.
• Takeover of communication accounts such as Telegram, LinkedIn, Slack, and Discord, and re-propagation to contacts.
• Attempts at dependency and repository supply chain attacks using open-source software (OSS) maintainer or developer accounts as stepping stones.

8. Observable Logs

• Email: Scheduling invitations from legitimate calendar services. According to the FBI, these invitations often lack meeting links, and malicious links are sent separately from compromised communication accounts immediately before the scheduled meeting. Cross-reference communication service histories alongside emails.
• Proxy / SWG / DNS: Connections to typosquats such as uu01webzoom.us and teams.livemeet.us, and connections to script and payload download destinations immediately after joining meetings.
• Endpoint / EDR: Inference: When corresponding telemetry is available, check for shell or terminal command execution after connecting to fake conferences, access to cookie databases or keychain and credential stores, keylogging, screen and camera capture, and backdoor persistence. Examine terminal windows opened separately by the user in addition to browser-spawned child processes, and collect copied command contents when accessible.
• Identity / IdP: New devices or sessions for communication, Git, and package registry accounts, along with MFA or recovery information changes and token reuse.
• SaaS / Cloud: Meeting invitations sent from compromised accounts to contacts, abnormal modifications to repositories or packages, and new sessions on cryptocurrency platforms.
• Network: Outbound traffic to unknown hosts after reaching conference URLs, periodic C2 communication, and large or encrypted data transmissions.

9. Attack Success Determination

• User Interaction Confirmed: The FBI has confirmed cases where targets followed instructions in fake conferences to execute scripts or commands. Verify this in individual investigations using shell histories, process trees, and download histories (Scope: Target endpoints).
• Malware Execution or Authentication Success Confirmed: The FBI has confirmed endpoint and account compromise caused by malware. Individual organizations should check for payload execution, persistence, and abnormal sessions (Scope: Endpoints and communication/developer accounts).
• Information Theft or Session Compromise Confirmed: The FBI reported that more than $400 million in cryptocurrency had been stolen over the preceding 18 months across the campaign and that it had seized more than 900 victim webcam recordings. The figure of over 900 represents the number of recordings, not unique victims (Scope: Campaign tracked by the FBI).
• Follow-on Compromise Confirmed: A cycle of reusing stolen accounts, contacts, and recorded footage against new targets has been confirmed. Attempts were made to inject malicious dependencies into JavaScript libraries, but widespread supply chain impact was prevented (Scope: Re-propagation using compromised accounts and footage, and the described JavaScript maintainer compromise; excludes widespread supply chain compromise success).

10. Investigation Playbook

• Trigger: Detect unexpected meeting invitations from known contacts, typosquat meeting URLs, terminal execution during meetings, or browser cookie access.
• Initial Checks: Verify inviters through alternative channels and preserve URLs, redirects, calendar events, chat histories, executed commands, and time synchronization.
• Endpoint: Collect browser histories, downloads, shell histories, process trees, persistence mechanisms, cookie and credential store access, screen and camera captures, and EDR telemetry.
• Identity / Cloud: Track sessions, tokens, MFA, recovery information, and repository modifications for communication, IdP, Git, package registry, and cryptocurrency services.
• Follow-on: Identify invitations and contacts sent from compromised accounts, and examine package publishes, dependencies, CI/CD secrets, and wallet transactions.
• Containment: Isolate devices, revoke sessions and tokens from trusted devices, and change passwords. If seed phrase exposure is suspected, create a wallet with a new seed phrase on a device not used for communicating with attackers, and transfer assets. Freeze and review package and repository changes.
• Classification: Determine stages for invitation receipt, fake conference connection, command execution, malware execution, session or asset theft, contact re-propagation, and supply chain modifications.

11. Defense and Detection Ideas

• Single Event: Inference: Depending on available telemetry, generate alerts for suspicious shell or terminal command execution guided during meetings, connections to typosquat meeting domains, and non-browser process access to cookie databases. Do not require shell or terminal parent processes to be browsers.
• Time-Series Correlation: Correlate calendar invitations, typosquat connections, shell execution, cookie access, and new identity sessions within short timeframes.
• Hunting: Search across environments for known domains, commands executed immediately following meetings, new sessions on communication accounts, and token usage on Git or package registries.
• Logging Gaps: Determining the full scope is difficult without logs from consumer communication services, browser extensions, terminals, camera access, and cryptocurrency services.
• Priority Controls: Prioritize alternative channel verification, official meeting clients, script execution blocks, phishing-resistant MFA, short-lived tokens, and mandatory reviews for developer accounts.

12. Facts, Inference, and Hypothesis

Facts

• The FBI published details regarding North Korean state-sponsored actors using compromised accounts and secretly recorded webcam footage to trick targets into executing malware from fake Zoom and Teams meetings.
• The FBI stated that more than $400 million in cryptocurrency had been stolen across the campaign over the preceding 18 months and that it had seized more than 900 victim webcam recordings. The figure of over 900 represents seized video recordings and does not necessarily reflect independently verified unique victims.
• The malware steals browser cookies, keystrokes, screens, and credentials, and establishes backdoors. Compromised accounts and contact histories are reused in subsequent attacks.
• After a maintainer of a major JavaScript library was compromised, attackers attempted to create malicious dependencies, but early detection and response prevented widespread supply chain impact. The FBI is also aware of separate attempts targeting npm and Rust maintainers.
• Arctic Wolf identified 677 target individuals across 58 countries within the attacker's media library, noting that 84% were founders or C-suite executives. This count represents individuals for whom the attackers prepared materials, not confirmed compromises.

Inference

• Because trusted accounts, recorded footage, and calendar services are combined, sender names and video alone should not be used to verify identity. Alternative channel verification and correlation across endpoints, identities, and developer services are required.

Hypothesis

No additional hypotheses. Unconfirmed items are listed in Unknowns and Limitations.

13. MITRE ATT&CK Mapping

14. Unknowns and Limitations

• Unique victim counts corresponding to the over 900 recordings, the breakdown of the $400+ million total, and the specific malware families and C2 servers used in individual intrusions cannot be determined from public information alone.
• While the FBI lists multiple cluster names that include overlapping identifiers for the same campaign, the specific subgroups responsible for individual intrusions were not disclosed.

15. Impact on SOCs and Organizations

Organizations operating in sectors such as cryptocurrency, Web3, finance, and open-source software maintenance, as well as development teams, can become high-value targets. Organizations must prohibit command execution justified by meeting disruptions, enforce alternative verification of identity, use official clients, detect suspicious shell or terminal execution regardless of process parent-child relationships with browsers, revoke sessions, and mandate reviews for package publishing and repository modifications.

16. Summary by Role

• SOC: Correlate time series across calendars, proxies, endpoints, identities, and Git or package registries to track command execution and session theft following fake conference connections.
• Administrators: Establish phishing-resistant MFA, short-lived tokens, script allowlisting, package publishing protections, and emergency session revocation procedures.
• Users: Do not execute scripts or terminal commands when requested during meetings, and verify inviters through alternative channels.