FaceStealer: The Fake Zoom Meeting Scam Behind $400M Stolen
FaceStealer: The Fake Zoom Meeting Scam That Stole $400 Million, Using Faces That Were Real
The FBI says North Korean hackers stole more than $400 million in 18 months by inviting crypto founders and executives to fake Zoom and Teams calls, sent from the hijacked accounts of people they knew. The faces on those calls were mostly genuine recordings. Here is how the chain works, why spotting a fake would not have stopped it, and the procedure that does.
The face on the call was real. The person was not there. A verification step gives the same answer either way.
What is the FaceStealer fake Zoom meeting scam?
FaceStealer is a fake Zoom meeting scam that the FBI says North Korean hackers used to steal more than $400 million in cryptocurrency in 18 months. Invitations arrive from hijacked accounts of people the target knows. On the call, genuine recordings of those contacts play, and an invented audio problem leads the target to run malware.
in cryptocurrency stolen through FaceStealer in 18 months, per the FBI
victim webcam recordings seized by the FBI, each one a ready-made lure
targets in 58 countries tracked by Arctic Wolf, more than 80% of them founders or C-suite
The FBI announced the scheme on November 12, 2026, and attributed it to a North Korean cluster tracked as Sapphire Sleet, or UNC1069, a group separate from the military hackers it linked to the recent Binance theft. Along with the recordings, the FBI seized the cloud infrastructure behind the campaign. The scheme reaches its targets through the oldest trust signal there is: a message from someone you know, followed by a face you recognize.
How the fake Zoom meeting scam works, step by step
FaceStealer is a loop. Each victim supplies the account, the contact list and the recorded face used against the next one.
Compromise one person and record them
Every chain starts with a real victim. The operators take over that person’s wallets and messaging accounts, such as Telegram, lock them out, read their contacts and chat history, and secretly record their webcam during a video call.
Message their contacts from the hijacked account
The invitation comes from someone the target already trusts. Writing as the victim, the operators propose a Zoom or Teams meeting about an investment opportunity, inside a conversation history that is entirely genuine.
Schedule it, then swap in a look-alike link
The booking looks routine. A Calendly invite arrives first. Shortly before the meeting, the hijacked account sends the real meeting link, which points to a typosquatted domain built to look like Zoom or Teams.
Stage the call with recordings of real people
The target sees a familiar face. The page plays the recorded webcam video of the trusted contact, plus other recordings to suggest more participants. The FBI says some calls now add AI-generated video of well-known crypto figures, but the scheme still relies mainly on genuine recordings.
Invent a technical problem and supply the fix
The payload is a helpful instruction. A message reports an audio fault or an outdated meeting component and asks the target to click a link, run a script or paste a command into a terminal. That step installs the malware that harvests wallets, credentials and session data.
Record the new victim and repeat
The target becomes the next lure. Their webcam stream is recorded while they wait on the call, and their accounts are used against their own contacts. The FBI says some thefts came months, or more than a year, after the first breach, once wallet balances had grown.
Step five is the consequential action. Everything before it builds enough trust that running a command to fix a call feels like ordinary troubleshooting. It is the same pattern behind the $11 million UXLINK deepfake video call, and it fits a growing list of deepfake attack examples where a familiar face replaced every other check.
Why spotting a deepfake would not have stopped FaceStealer
Most advice on fake video calls tells people to look for glitches: odd blinking, lip-sync drift, strange lighting. Against FaceStealer that advice has nothing to work with. The FBI says the scheme relies mainly on genuine recordings. The face is the real contact. The voice is theirs. The chat history is theirs. There is no artifact to find.
“Does this look and sound like my contact?” Against a genuine recording, the honest answer is yes, and the check passes the adversary straight through.
“Did I confirm this meeting through a channel I already trust, and did I join through the official app?” The answer does not change with the quality of the video.
This is what we call Synthetic Normalization: plausibility beats fidelity. A face only has to be plausible in context to be trusted, and a real recording inside a real conversation is as plausible as it gets. It is why we argue that deepfake detection training is a decaying control when it depends on human perception.
Technical controls are a different story, and they matter here. Endpoint protection that flags a script pasted into a terminal, application control that blocks unsigned installers, and wallet and payment platforms that require strong authentication all hold their value regardless of how convincing the call is. FaceStealer is built to get a person to switch those defenses off by hand, which is why the human procedure in front of them has to hold too.
A face on a call is not a credential. Treat an unexpected invite like an unknown sender, however well you know the name on it.
The FBI guidance, and the control behind each step
The FBI published three pieces of advice with the announcement. Each one is a procedure, not a perception test.
| FBI advice | The control it is | Step it breaks |
|---|---|---|
| Confirm unexpected meeting invitations through a separate channel | Out-of-band verification bound to the request, not to the sender’s account | Step 02, the invite from a hijacked contact |
| Join through the official app using the meeting code | A known-good path that never follows a link from the invite | Step 03, the look-alike meeting domain |
| Keep your webcam off until you can see, hear and speak with the person who invited you | A live, two-way check before you give anything up | Step 06, the recording that becomes the next lure |
FBI guidance as reported by BNO News. Campaign detail from Reuters and The Hacker News.
We would add one rule the chain makes obvious: nobody runs a script, pastes a command or installs a component to fix a meeting. A real Zoom, Teams or Meet problem is solved by rejoining through the official app or calling IT on a known number. That single rule breaks step five, the only step that actually costs money.
This is not only a crypto problem
The FBI says FaceStealer primarily targeted cryptocurrency and Web3 professionals, because that is where a single compromised laptop can empty a wallet. The method transfers to any organization. Every company runs on meeting invites from known contacts, and every company has consequential actions a compromised device can reach: a payment approval, a credential reset, access to a production system.
- Treat the invite as the request. An unexpected meeting about money, access or software is confirmed on a channel already on file before anyone joins.
- Remove the fix from the call. Write down that meeting problems are never solved by running code on request, and give people a known IT number to call instead.
- Make reporting the easy path. A person who reports a strange invite from a colleague may be the first to know that colleague’s account has been taken over. Blameless, fast reporting turns one victim into an early warning.
The data behind the average cost of a deepfake attack points the same way. The loss is set by the action the adversary reaches and by whether a verification step stands in front of it, not by how good the fake looks.
How Breacher.ai tests whether your meeting procedures hold
Written procedures are a start. The question that matters is whether they run when a familiar name sends an urgent invite and a familiar face is waiting on the call. Breacher.ai answers that with authorized, orchestrated social engineering simulations from our OSES™ engine, combining email, messaging, live two-way AI voice and interactive video avatars that join real Teams, Zoom and Meet meetings, adapting each step to how your people respond, all the way to the consequential action.
From one fake invite to evidence your board can read
Findings are named against procedures, not people. You see whether invites were verified out of band, whether anyone reported the request, and whether the consequential action was taken. OSES™ Behave then generates training on the exact procedure that slipped, aligned to your own policies. The next simulation shows whether it now holds, and your OSES™ Risk Index score shows the change.
Meeting-based scenarios run through our deepfake simulation and Microsoft Teams impersonation simulation, all on the Breacher.ai simulation platform.
Measure your risk.
Train for what you find.
Prove it changed.
See whether a familiar face on a call can get your people to act before they verify.
Book Your DemoFrequently asked questions
FaceStealer is a fake Zoom meeting scam that the FBI says North Korean hackers used to steal more than $400 million in cryptocurrency in 18 months. Invitations arrive from hijacked accounts of people the target knows. On the call, genuine recordings of those contacts play, and an invented audio problem leads the target to run malware.
The FBI attributes FaceStealer to North Korean state-backed hackers tracked as Sapphire Sleet, also known as UNC1069 and associated with BlueNoroff. The FBI says this cluster is separate from the North Korean military hackers it linked to the Binance theft.
Mostly not. The FBI says the scheme relies mainly on genuine webcam recordings of earlier victims, played back on a fake meeting page. The operators have started adding AI-generated video of prominent cryptocurrency figures, but the familiar faces were usually real recordings of real people.
Do not rely on how the invite or the faces look. Confirm any unexpected meeting through a separate channel you already trust, join through the official Zoom, Teams or Meet app using the meeting code, and keep your webcam off until you can see, hear and speak with the person who invited you, as the FBI advises.
The FBI says FaceStealer primarily targeted people and companies in the cryptocurrency and Web3 sectors, mostly founders and executives. The method is not specific to crypto. Any organization whose people accept meeting invitations from known contacts, and could be asked to run a fix during a call, faces the same chain.
Run an authorized simulation that uses the same chain: an invitation from a familiar sender, a meeting on Teams, Zoom or Meet, and a request to take a consequential action. Breacher.ai runs these as orchestrated simulations and measures whether verification ran, whether the event was reported, and whether the action was taken.
Test the Invite Before an Adversary Does
Thirty minutes. We show you how a meeting-based simulation runs against your own procedures, and which verification step would have stopped FaceStealer.
Book Your DemoLatest Posts
Table Of Contents
About the Author: Jason Thatcher
support@breacher.ai
