FaceStealer scam: fake 'you're on mute' calls tied to $400M

How does the FaceStealer scam work?

It starts with a meeting invite from a hijacked account, so the sender is someone you may really know. FBI Los Angeles agent Jeremy Robertson said the message often builds on past conversations or shared interests, and the calendar invite contains typo-squatted URLs, meaning addresses that look almost right.

The link opens a fake Zoom or Teams meeting. The attackers record your webcam while playing a prerecorded video of the person who supposedly invited you, sometimes a deepfake of a well-known crypto figure. You see their face and their lips moving, but hear nothing. A text box then says you need to upgrade your software to get audio, and offers a link.

That link installs malware that steals cryptocurrency and sends your contact list to the thieves, so the scam can move on to the next person.

Who is behind it, and who is targeted?

The FBI ties FaceStealer to Sapphire Sleet, a group also known as UNC1069, Stardust Chollima, APT38 and BlueNoroff, widely seen as an offshoot of the Lazarus Group. Targets are mainly people in crypto and web3, plus open source developers and maintainers. Hackers want access to the code repositories those developers control, as a first step toward supply chain attacks.

FBI Cyber Division assistant director Brett Leatherman said North Korean hackers increasingly mix intrusion, social engineering and tools like deepfakes to make impersonation more convincing.

On Binance, the FBI blames the October 29 theft on TraderTraitor, another North Korea-linked group. Binance said the attackers began preparing in June, using fake job interviews, malware, compromised internal AI tooling and an advanced transaction-authorization method. Investigators and private partners have helped freeze more than $2.7 billion of the stolen assets, and the court authorization covers over $1.2 billion of that.