The FBI spoke Thursday about a social-engineering scheme called FaceStealer, describing it as a highly effective North Korean operation that uses imposter video-conferencing platforms, secretly recorded webcam footage and computer intrusions to steal from people working in cryptocurrency and web3 industries. Federal officials say the scheme has already siphoned off more than $400 million in the 18 months leading up to its disruption.
The bureau has described the scheme as capable of fooling even seasoned tech professionals. “North Korea's FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user,” said Patrick Grandy, Assistant Director in Charge of the FBI's Los Angeles Field Office, per the bureau's statement. As reported by The Record from Recorded Future News, hackers lure targets with Calendly invitations to Zoom or Teams meetings sent from accounts stolen from prior victims, with links that lead to fake domains capable of compromising a target before a meeting even begins.
How the Fake Meeting Trap Works
Once a target clicks into the sham meeting, the scheme typically presents a supposed technical glitch as the pretext for installing malware. The same outlet's reporting notes that the “fix” usually installs a browser cookie harvester, keyloggers, screen capturers and a backdoor onto the infected device. The attackers also record the target's webcam video, which can later be used to deceive that person's trusted contacts into falling for the same trick.
Grandy said the scheme works precisely because it exploits everyday habits and relationships. “It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” he said, according to the FBI. “If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough.”
Federal Agencies Move to Disrupt the Network
The FBI and the Department of Justice announced disruption of cloud-based infrastructure that North Korean hackers used to run the scheme. The Justice Department said the FBI seized more than 900 webcam videos belonging to FaceStealer victims in crypto and web3 industries around the world, pursuant to a federal warrant, though the specifics of that operation remain limited to the department's own public summary.
The FBI has published a report detailing the FaceStealer scheme along with protective practices and steps for victims to take after a compromise, and the bureau has created a centralized website for FaceStealer resources and information. Grandy said the goal is to widen awareness of a scheme that has moved beyond simple crypto theft. “The FBI is sounding the alarm to elevate awareness of this growing scheme, now aimed not only at crypto theft, but also the exploitation of the open-source software supply chain,” he said.
Open-Source Developers Now in the Crosshairs
Federal officials say North Korean hackers increasingly target people involved in developing and maintaining open-source software, seeking access to targets' devices and software-repository accounts in ways that appear calculated to enable supply-chain attacks. Decrypt reports that North Korean hackers have increasingly gone after open-source developers specifically in an apparent bid to enable those kinds of attacks.
That targeting pattern tracks with a separate campaign detailed by SecurityWeek, which reported that the so-called PolinRider campaign has been running since December 2025 using compromised GitHub repositories injected with JavaScript loaders. The outlet cited research from Socket identifying 162 malicious release artifacts spread across 108 unique packages tied to that campaign.
AI Deepfakes and a Growing Crypto Toll
Federal officials say hackers are starting to use artificial intelligence to generate deepfake videos of influential figures in the cryptocurrency and blockchain industries, according to ThePrint. The tactic adds another layer of deception to a scheme already built around exploiting trust in familiar faces and familiar platforms.
The scale of North Korea's broader crypto-targeting campaign has drawn scrutiny well beyond the FaceStealer warning. Binance has said it detected and prevented 57 North Korea-related hacking attempts in 2026 alone, according to Fortune. The exchange has also described how hackers targeted one of its engineers through LinkedIn outreach and a series of fake job interviews, eventually getting the employee to download malicious software after clicking an ad for a tampered version of Homebrew, a move that helped attackers learn about the engineer's role and colleagues who managed company wallets. Binance said that intrusion alone resulted in theft of around $6.3 billion, though about $2.5 billion was later recovered after Tether and Circle froze the stolen stablecoins.
