Key Highlights
- FaceStealer attackers use realistic fake video-conferencing platforms to install malware on targets’ computers.
- The campaign can lead to cryptocurrency theft, account hijacking, stolen communications and software supply-chain attacks.
- The DOJ separately authorized action involving more than $1.2 billion in assets linked to a Binance theft attributed to North Korean activity.
How the FaceStealer Video-Call Scam Works
Attackers behind the FaceStealer campaign reportedly use video calls to gain access to victims’ computers. During a call, they claim a technical problem—such as the target’s audio not working—and provide a link or prompt that supposedly fixes the issue. According to the U.S. Department of Justice, following that instruction installs malware on the victim’s computer.
The FBI’s FaceStealer resource page describes realistic imposter versions of video-conferencing platforms used in the operation. By imitating familiar software and creating a plausible technical issue, the attackers turn routine communication signals into a social-engineering trap.
Crypto Theft and Software Supply-Chain Risks
The threat extends beyond the cryptocurrency holdings of an individual victim. The DOJ said attackers can exploit a compromised user’s access to additional computer infrastructure. They are also increasingly targeting open-source developers and maintainers to obtain access to software repository accounts.
According to the department, that access appears designed to enable software supply-chain attacks that could ultimately affect users of compromised software. The FBI seized more than 900 webcam videos belonging to FaceStealer victims under a federal warrant. Attackers also collect victims’ contact lists and communications accounts, which can then be used to approach new targets.
In several reported cases, cryptocurrency theft and account hijacking took place months to more than a year after the initial compromise. The delay can make the original intrusion harder to identify and allows attackers time to exploit access across accounts, devices and connected systems.
FBI Warning Echoes Earlier North Korean Social-Engineering Tactics
The video-call lure builds on a pattern identified by the FBI in September 2024. At the time, the agency warned that requests to run scripts to enable calls could indicate North Korean social engineering. DeFi employees were among the reported targets, as The Defiant reported at the time.
The earlier advisory recommended verifying contacts through separate, unconnected communication platforms. It also advised organizations to restrict which files company devices can download or execute, reducing the opportunity for attackers to use fraudulent call-related instructions to deploy malware.
Separate DOJ Action Involving Stolen Binance Assets
In the same announcement, the DOJ said it had obtained court authorization to seize or restrain more than $1.2 billion in assets connected to a separate theft from Binance. The amount forms part of more than $2.7 billion frozen through government and private-sector efforts; it is not an additional recovery on top of that total.
The FBI attributed the theft of more than $6 billion on or about Oct. 29 to North Korean activity identified as TraderTraitor. The DOJ explicitly distinguished that operation from FaceStealer.
Efforts to trace, freeze, seize and forfeit the Binance-related assets remain ongoing. The DOJ said the attackers continue laundering funds through bridges, mixers and cryptocurrency exchanges.
Why This Matters
FaceStealer demonstrates how attackers can combine impersonated software, social engineering and delayed exploitation to target both individuals and wider technology ecosystems. The reported focus on open-source developers and maintainers raises the risk that a single compromised repository account could become a pathway into software used by many other organizations and users.
The separate Binance asset-recovery action also highlights the continuing effort by authorities and private companies to track cryptocurrency after major thefts. However, the use of bridges, mixers and exchanges can complicate tracing and recovery, leaving seizure and forfeiture proceedings ongoing.
Frequently Asked Questions
What is FaceStealer?
FaceStealer is the name used for an attack campaign involving realistic fake video-conferencing platforms and malware delivered through fraudulent technical fixes during calls.
What can attackers do after compromising a victim?
They can potentially access cryptocurrency, hijack accounts, collect contact lists and communications accounts, and exploit access to computer infrastructure or software repository accounts.
Is the Binance theft the same as FaceStealer?
No. The DOJ explicitly distinguished the Binance theft from FaceStealer. The FBI attributed the Binance incident to North Korean activity known as TraderTraitor.
