FaceStealer fake video meetings disrupted as US seizes infrastructure

A familiar face appears on a video call, but the other person says your microphone is broken and asks you to install a fix. The FBI says that scene is central to FaceStealer. On November 12, the US Justice Department announced the seizure of cloud infrastructure used in the scheme, which it attributes to North Korean hackers.

Getting people to install software is an established support-scam tactic. Microsoft’s security guidance describes invented problems and applications that give scammers remote access. FaceStealer moves the repair request into what looks like a working meeting. The FBI’s dedicated resource page describes invitations from hijacked communication accounts and meetings displaying recordings of earlier victims. An impostor claiming to be technical support must establish credibility; a familiar account and face bring that credibility into the room before troubleshooting begins.

Reuters reported the FBI’s estimate of more than $400 million in cryptocurrency stolen over 18 months. The Justice Department says agents obtained more than 900 victim webcam videos under a federal warrant. It also describes cases in which cryptocurrency theft and account takeovers followed the original infection by months or more than a year. The FBI says open-source maintainers are also being targeted for access to their devices and software repository accounts.

It is like someone playing a recording of your friend at the door, then asking you to remove the lock because the doorbell is faulty. The dangerous turn is the request to install a supposed repair. The US Federal Trade Commission explains that malware can steal account credentials and expose a device to further infections. Even security software may miss it temporarily. In the chain described by the FBI, recordings build trust, malware opens access and stolen accounts lead to new contacts. Scrutinizing the face alone misses that installation request.

The FBI recommends official meeting apps and meeting codes, plus confirming invitations through another known contact channel. Do not run scripts or paste commands into a terminal to satisfy an in-call update request. If malware is suspected, the FTC advises stopping sensitive account logins on the affected device, updating security software, scanning, changing passwords and enabling two-factor authentication. The FBI also recommends alerting contacts and employers before a stolen identity becomes the next lure.

Original sources published: US Justice Department and FBI technical alert, November 12, 2026; Reuters, November 13, 2026, 05:40 Beijing time / November 12, 2026, 4:40 PM EST.