All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
The FBI found more than 900 webcam recordings in a North Korean hacking operation that used victims’ faces to deceive their friends and colleagues.
In a November 12 announcement, the bureau said it had seized the videos while disrupting cloud infrastructure behind a scheme it calls FaceStealer.[1] Attackers replayed footage of earlier victims in fake video meetings, making new targets believe they were speaking with someone they knew.
The operation stole more than $400 million in cryptocurrency over the past 18 months, according to the FBI. Its targets include people working in cryptocurrency and Web3, along with developers who maintain open-source software.
For those caught in it, the privacy violation can spread beyond their own computer. A stolen recording can help hackers approach the next person in their contact list.
An invitation arrives from a familiar account. You join what looks like a Zoom or Microsoft Teams meeting, and someone you recognize appears on camera.
Behind that familiar face, however, is an attacker playing a recording.
The Justice Department’s account of the operation describes hackers recording the new target while showing footage of previous victims. They then invent a technical problem, such as claiming the target’s microphone isn’t working, and offer a link or prompt to fix it.
Following that instruction installs malware. This kind of social engineering attack uses your trust in another person to get you to do something dangerous. Attackers can steal cryptocurrency, take over communication accounts, and use the victim’s contacts to arrange more meetings.
“It exploits our trust in ubiquitous video conference platforms and valued personal relationships,” said Patrick Grandy, assistant director in charge of the FBI’s Los Angeles Field Office.
Some thefts and account hijackings happened months to more than a year after the initial compromise. An uneventful few days after a suspicious call therefore offers little reassurance.
You may already have given the fake meeting access to your camera before anyone mentions an audio problem.
In its July analysis of a related BlueNoroff attack kit, security company JUMPSEC reconstructed counterfeit Zoom and Teams pages from exposed source code.
The page requested webcam permission as a normal meeting would. Once granted, the camera feed went to the attackers’ control panel while the target moved through a convincing meeting interface.
JUMPSEC also found versions designed to compromise both Windows and Mac computers. Its research predates the FBI announcement, showing how the machinery behind these fake calls was already operating.
The familiar branding, camera prompt and waiting screen all help make the experience feel routine. By the time a supposed colleague offers troubleshooting instructions, the target has already accepted several parts of the setup.
Reviewing which websites and apps have permission to access your webcam can help you limit where your camera feed is available.
The FBI’s November 12 advisory recommends joining through the official conferencing application with an invite code. It also advises leaving your webcam off until you can see, hear and communicate with the person who invited you.
Confirm an unexpected invitation through another channel. If it arrived through Telegram, for example, call or text the person using contact information you already have.
If a meeting asks you to paste code into Terminal or a command window, stop. Update the official application separately.
Familiar account details deserve the same scrutiny. AAC has previously covered how stolen browser sessions can give attackers access to accounts, helping explain why a message from a real account can still be dangerous.
The FBI advises suspected victims to change passwords, end active account sessions and enable multifactor authentication. Warn your contacts that someone may impersonate you using recorded video, and notify your employer if work devices or files were involved.
Crypto holders should create a new wallet with new recovery phrases on a clean device and transfer their assets. Report the incident through IC3.gov using the keyword “FaceStealer.”
ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription
/images/2023/12/05/aura-vs.-lifelock.png)
/images/2023/06/09/aura-review.png)
/images/2026/11/13/meta-smart-glasses-hack.png)
/images/2026/11/13/fbi_seized_900_secretly_recorded_webcam_videos_from_a_fake_zoom_call_scam.png)
/images/2026/11/12/mobile_police_wont_say_how_they_use_clearview_ais_100_billion_face_photos.png)
/images/2026/11/09/sony-ad-scent-patent.png)
/images/2026/11/09/plex-server-security-flaws.jpeg)
/images/2026/11/06/mamdani_wants_to_stop_madison_square_garden_from_scanning_your_face.png)
/authors/thomas-kent-headshot-cropped.png){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/05/25/logo-aura.png){kind=logo}
/authors/thomas-kent-headshot-cropped.png)