Actively exploited Security news
FBI disrupts North Korea's FaceStealer fake video call campaign as the US moves to seize $1.2 billion from the Binance theft
On 12 November 2026 the US Department of Justice announced two actions against North Korean cryptocurrency theft. The FBI disrupted cloud infrastructure behind FaceStealer, a campaign that lures crypto workers and open-source developers into fake video calls and installs malware disguised as a fix for an audio problem. Separately, a court authorised the seizure or restraint of more than $1.2 billion from the theft of over $6 billion from Binance on 29 October. Here is how the trick works and what to do if you joined one of these calls.
Key points
- According to the Justice Department, on 12 November 2026 the FBI disrupted FaceStealer's cloud infrastructure and, under a federal warrant, seized more than 900 webcam recordings of victims.
- The attackers send meeting invites from accounts stolen from earlier victims, play recordings of people the target knows or deepfake videos, then fake a technical problem – and the fix installs malware.
- The FBI says FaceStealer has stolen over $400 million in cryptocurrency in 18 months and has also gone after open-source developers, which it sees as groundwork for software supply chain attacks.
- Of the more than $6 billion stolen from Binance on 29 October 2026, which the FBI attributes to North Korea's TraderTraitor, over $2.7 billion has been frozen and a court has authorised the seizure or restraint of over $1.2 billion.
What happened
On 12 November 2026 the US Department of Justice (DOJ) announced two actions against cryptocurrency theft it attributes to North Korea.
FaceStealer. The US Attorney's Office for the Central District of California and the FBI's Los Angeles Field Office disrupted the cloud infrastructure behind this social engineering campaign. Under a federal warrant, the FBI seized more than 900 webcam recordings of victims. The FBI says the scheme has netted over $400 million in cryptocurrency over the past 18 months and has included attempts to compromise people in the open-source software supply chain. The DOJ lists the groups behind it as Sapphire Sleet, UNC1069, BlueNoroff, APT38, CryptoCore, Dangerous Password and Stardust Chollima.
Binance. On or about 29 October 2026, according to the DOJ, members of the North Korean military whom the FBI calls TraderTraitor stole more than $6 billion in virtual assets from the Binance exchange. They are still laundering the funds through cross-chain bridges, mixers and exchanges. US agencies and private companies have so far frozen over $2.7 billion, and a court has authorised the department to seize or restrain more than $1.2 billion of it.
How the attacks worked
How FaceStealer operates, according to the DOJ:
The FBI says some thefts and account takeovers happened months, sometimes more than a year, after the initial compromise. The attackers also harvest the victim's contacts, social media and messaging apps to approach friends and colleagues – which is why the invites look trustworthy.
Mandiant (Google) described the same trick in detail on 9 February 2026 for UNC1069, one of the names the DOJ lists. In the case it investigated, the message came from a hijacked Telegram account, a Calendly link led to a spoofed Zoom meeting on attacker-controlled infrastructure, and the "audio fix" was a macOS Terminal command that downloaded and ran a script (the ClickFix technique). The page had a separate set of commands ready for Windows. Seven malware families followed, including WAVESHAPER, HYPERCALL, SUGARLOADER and DEEPBREATH, which stole credentials, browser data and session tokens.
Who is affected
- people in the cryptocurrency and Web3 industry – staff at exchanges, funds and start-ups, and investors,
- open-source developers and maintainers, because their repository and package registry accounts are a route to a project's users,
- indirectly, all of their contacts: hijacked accounts and webcam recordings are used to approach new victims.
The FBI hasn't published malware names or domains for the current campaign. The Binance theft doesn't directly affect ordinary people, but it is a favourite hook for fake "fund recovery" services.
How to spot compromise
- You joined a call where your audio "didn't work", were given a link, file or command to fix it – and ran it.
- A contact says you sent them an invite you know nothing about (your account may have been hijacked).
- Mandiant published these network indicators for UNC1069 (February 2026; FaceStealer's current infrastructure may differ). Defanged, for searching DNS and proxy logs:
mylingocoin[.]com
zoom[.]uswe05[.]us
supportzm[.]com
zmsupport[.]com
breakdream[.]com
dreamdie[.]com
support-zoom[.]us
cmailer[.]proTo pull domains out of your own logs or emails, use our IOC extractor – it runs entirely in your browser.
What to do
- Confirm invites through another channel – call or message the person through a different app from the one the invite came through.
- Don't run anything during a call. No Terminal or PowerShell commands, no "drivers", "plugins" or "SDK updates". Genuine meetings run in the vendor's official app or on its official domain.
- If you ran the fix: disconnect the device, don't send crypto from it, and from a separate clean device reset passwords, sign out all sessions, revoke repository, package registry and cloud tokens, and move funds out of any wallets the machine could reach. The IC3 advisory has steps for victims. Our password generator creates strong new passwords locally.
- Warn your contacts that fake invites may arrive in your name.
- Report it – in the US to the FBI at ic3.gov, in the UK to Action Fraud or the NCSC if an organisation is affected.
Timeline
Updates
- 13 November 2026 – first version.
FAQ
How do I recognise FaceStealer?
According to the FBI, the invite comes from someone you know, but from their hijacked account. On the call you see familiar faces – recordings from earlier calls or deepfakes – and then a technical problem appears, typically that nobody can hear you, along with a link or a command to fix it. No genuine video meeting needs you to download anything or paste commands into Terminal to fix your audio.
I joined one of these calls but didn't run anything. Am I safe?
Based on the FBI's description, the infection comes with the fix. But assume the attackers may have recorded your webcam and could use the footage against your contacts. Warn the people you deal with and check that nobody has taken over the account the invite came through (Telegram, LinkedIn, email).
Why would the attackers care about open-source developers?
The FBI says the attackers target open-source developers and maintainers to get into their devices and code repository accounts, and assesses that this is aimed at software supply chain attacks. A stolen repository or package registry token can reach every user of a project.
Did Binance customers lose money?
The Justice Department's announcement doesn't address customer balances. It gives the amount stolen (over $6 billion), the $2.7 billion frozen and the $1.2 billion a court has authorised for seizure or restraint. Check your account only in the exchange's official app – messages promising to recover money lost in the hack are a common scam.
Sources
- U.S. Department of Justice – Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency (12 Nov 2026)
- FBI / IC3 – FaceStealer advisory with best practices and victim steps (12 Nov 2026, PDF)
- Google Threat Intelligence (Mandiant) – UNC1069 Targets Cryptocurrency Sector with New Tooling and AI-Enabled Social Engineering (9 Feb 2026)
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
Arara Message breach: 81 million email addresses stolen and phishing sent in card issuers' names
An attacker broke into Arara Message, a Japanese bulk email delivery service, took more than 81 million email addresses belonging to the customers of roughly 380 companies, and used the service itself to send up to 7.13 million phishing emails posing as credit card companies. The fallout is now reaching downstream customers: on 13 November 2026 the City of Osaka disclosed that 1.08 million addresses of users of its online services system were exposed. Here is what is confirmed and what it means for defenders and users.
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.