FaceStealer Deepfake Scam: 7 Ways to Protect Your Team From Fake Video Calls

The FaceStealer deepfake scam has now cost victims more than $400 million in cryptocurrency, according to the FBI, and it spreads through something every company uses daily: the video meeting. On November 12, 2026, the FBI and the US Justice Department went public with the scheme, linking it to North Korean hackers and announcing the seizure of the cloud infrastructure behind it.

Here is the thing. This is not a clever piece of malware hiding in an email attachment. It is a social engineering chain that uses stolen webcam footage, AI deepfakes and hijacked chat accounts to make a fake meeting look completely normal. If your team takes calls with investors, partners or clients, this one is worth ten minutes of your time.

What the FBI Revealed About FaceStealer

According to The Hacker News, the FBI says North Korea-linked actors stole more than $400 million over roughly 18 months using FaceStealer. Authorities seized the cloud infrastructure behind the operation and more than 900 victim webcam recordings.

The same day, the Justice Department announced a court-authorized seizure and restraint of more than $1.2 billion in crypto stolen by TraderTraitor actors after the Binance hack, in a separate DOJ announcement. The FBI has also published a dedicated page on the FaceStealer theft scheme.

FBI Cyber Branch Operations Director Brett Leatherman said North Korean cyber actors have used the scheme “to aggressively target individuals” in crypto and Web3.

How the Fake Meeting Attack Works

The chain is simple, which is exactly why it works. Based on the FBI disclosure and reporting, it runs like this:

First, the attackers compromise one person. They take over a messaging account, usually Telegram, harvest wallets and seed phrases, and quietly record that person’s video calls.

Next, posing as the victim, they message the victim’s contacts and propose a Zoom or Teams call about an investment. A Calendly invite follows. Shortly before the meeting, a typosquatted meeting link arrives.

On the call, the target sees real recorded footage of earlier victims, plus deepfakes of well-known figures. It looks like a full, busy meeting. Then comes the trap: a fake audio error and a “fix” that the target runs themselves. That fix installs malware and steals data.

And then the cycle repeats with the new victim’s contacts. Self-propagating, basically. Scary.

Why the FaceStealer Deepfake Scam Hits Founders First

Arctic Wolf reported in April 2026 that the campaign had hit more than 400 victims in over 20 countries. Since then, the activity has grown to 677 targets in 58 countries, and more than 80% are founders or C-suite executives, per The Hacker News. You can read Arctic Wolf’s follow-up research on BlueNoroff six months on.

Executives make fast decisions, take lots of external calls and often have access to money or sensitive systems. Attackers now scrape YouTube interviews and conference talks to build fake footage of specific people, so they do not even need to compromise the person they are impersonating first.

The attackers also went after software maintainers. They targeted the maintainer of the Axios npm package, which led to a trojanized release that delivered a cross-platform remote access trojan. That is the moment this stopped being a crypto problem and became a software supply chain problem for everyone.

7 Ways to Protect Your Team From Fake Video Calls

Let me be direct: no single tool stops this. What stops it is a handful of habits plus a few technical controls. Here is where I would start.

• 1. Verify out of band: If a meeting request involves money, credentials or software, confirm it through a different channel, like a phone number you already have.
• 2. Never install a “fix” during a call: No legitimate meeting needs you to paste a command or download an audio driver mid-call. Make this a written company rule.
• 3. Restrict meeting domains: Allow only approved Zoom, Teams or Meet domains through your web filter, and block lookalike domains.
• 4. Detect paste-and-run behavior: Endpoint tools can flag terminals or PowerShell launched right after clipboard pastes. Turn those detections on.
• 5. Lock down chat accounts: Enforce strong MFA on Telegram, Slack, LinkedIn and Discord. A hijacked chat account is the starting point of this whole chain.
• 6. Isolate developer work: Run unknown repos, coding tests and packages in a disposable virtual machine, never on a work laptop with production credentials.
• 7. Train with real examples: Show your team what a typosquatted meeting link and a fake audio error look like. Awareness beats theory.

The Bigger Pattern: Fake Recruiters and Poisoned Repos

FaceStealer is not the only North Korean campaign targeting tech workers. The Hacker News also points to ClickFake Interview, part of the wider Contagious Interview activity, which uses fake recruiter outreach. A joint advisory from Japan, the US, Australia and Germany in late September 2026 estimated at least 30,000 devices compromised across 100 countries.

The delivery tricks are aimed squarely at developers: malware hidden in coding tests, VS Code tasks.json files that run code when a project opens, Git hooks that fire on first commit, and trojanized macOS installers. Sophos found one compromised Mac in September 2026 after an employee opened an interview repo in VS Code.

So yeah, if you hire developers or work as one, this is your threat model now.

What US Businesses Should Do This Week

Start small. Add a one-line rule to your security policy: no software installs requested during a call. Then review which meeting platforms you actually allow, and turn on MFA everywhere your staff chat with outsiders.

For engineering teams, check whether your CI pipelines would catch a trojanized package update. Pin dependencies, review lockfile changes and watch for unexpected maintainer changes in popular packages you rely on. The Axios case shows that one compromised maintainer can reach thousands of downstream projects.

Finance teams need a playbook too. Any payment, wallet transfer or change of bank details agreed on a video call should require a second sign-off from someone who was not on that call. It feels slow. It is also the cheapest insurance you will ever buy, because deepfakes are only getting better and cheaper to produce.

Finally, the FBI FLASH advisory includes technical details your security team can use for detection. Hand it to them today.

Key Takeaways

• Big losses: The FBI links FaceStealer to more than $400 million in crypto theft over about 18 months.
• Infrastructure seized: US authorities took down the cloud infrastructure and more than 900 victim recordings.
• Executives are targets: More than 80% of 677 known targets are founders or C-suite leaders.
• Supply chain risk: The Axios npm maintainer attack shows developers are in scope.
• Habits matter most: Out-of-band verification and a no-installs-on-calls rule block the core trick.

How TecniForge Can Help

At TecniForge, we help businesses navigate these technology shifts. Whether you need custom software development, AI integration, or cloud migration, our team builds scalable solutions. We also help teams harden development pipelines, secure endpoints and design safer internal tools. Talk to our experts.

Would your team spot a fake audio error on a call with someone they trust?