The FBI and the US Justice Department said on Thursday, 12 November 2026 that they had disrupted a scheme called FaceStealer, which they say hackers linked to North Korea used to steal more than 400 million dollars in cryptocurrency over the past 18 months.
How does the scheme work? It starts with a meeting invitation sent from an account stolen from an earlier victim. The target joins what looks like a familiar video meeting platform and sees a prerecorded video of someone they know. A fake technical error then appears, such as an audio problem, and the suggested fix secretly installs malware on the target's computer, while their webcam is recorded to lure the next victim.
Who was targeted? The Justice Department said the scheme hit people in the cryptocurrency and Web3 sectors and, increasingly, open-source software developers and maintainers, which it said appears aimed at software supply-chain attacks. "The victims are all experienced crypto/Web3 executives, developers and even cybersecurity experts," said Jeremy Robertson, a special agent at the FBI's Los Angeles Field Office.
Is artificial intelligence involved? Yes. According to the department, the scheme "relies on surreptitiously recorded videos and artificial deepfakes."
What have the authorities done? Federal prosecutors in California disrupted the cloud infrastructure behind the scheme, and the FBI seized more than 900 webcam videos of victims under a warrant.
What is the main warning? A pop-up error during a call that asks you to run an update or a command can be the way the malware gets in. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough," said Patrick Grandy, the FBI official in charge in Los Angeles.
Source: US Department of Justice, FBI, Nextgov, NBC Los Angeles
