FBI warns crypto users of fake Zoom and Teams calls from hijacked contacts

SCAM ALERTConsumer alert, published November 13, 2026

The FBI warned in a FLASH alert dated Nov 12, 2026, that North Korean state-sponsored hackers are sending fake video call invites from the hijacked accounts of people their targets already know. The FBI says the scheme, which it calls “FaceStealer,” has taken more than $400 million in cryptocurrency over about 18 months. People and companies that hold crypto are the main targets, along with some open-source software developers.

What is happening

The FBI’s FLASH alert, numbered AC-111226-MS and dated Nov 12, 2026, says the scheme is run by North Korean state-sponsored actors. Security researchers track these groups under several names, including Sapphire Sleet, UNC1069, APT38 and BlueNoroff.

The FBI says the group has taken more than $400 million in cryptocurrency over about 18 months. Some news headlines have said “about two years.” The FBI’s own figure is about 18 months.

The FBI says the actors have mainly gone after individuals and companies. Some attempts have targeted people who build and maintain open-source software. The FBI notes that this could give the attackers a way to reach many downstream users of that software.

The Justice Department’s Office of Public Affairs announced separate actions to disrupt North Korea’s cryptocurrency theft. It said it disrupted cloud infrastructure used in the FaceStealer scheme. Under a federal warrant, it also seized more than 900 webcam videos of victims.

This is not a new kind of threat. In September 2024, the FBI warned in public service announcement PSA240903 that North Korean actors were running social engineering campaigns against people who work in decentralized finance and crypto. In January 2025, it warned in PSA250123 about North Korean crypto theft known as TraderTraitor. In 2025, a security industry group called the Security Alliance (SEAL) reported tracking several North Korean “fake Zoom” attempts every day.

How the scam works

The FBI alert describes the steps in order.

First, you get an invitation to a video meeting on Zoom, Teams or Google Meet. It comes from the account of someone you know, such as a colleague, a business contact or a person you have talked with about crypto. That account has been hijacked. The invite looks normal because it really does come from that person’s account.

Second, when you join, you see what looks like a live person on camera. The FBI says the attackers play recordings of earlier victims’ webcam footage to look trustworthy. While you talk, they record your own webcam. Your face can then be used to fool the next victim.

Third, the call appears to break. The attackers claim there is a technical problem with audio, video or the meeting software. They talk you into installing something to fix it. That “fix” is malware, and it opens the door to your crypto.

The FBI says the group has started using AI deepfakes. But the scheme still relies overwhelmingly on real videos stolen from past victims. So the face you see may be a real person, just not the person you are talking to.

How to spot it

• A video call invite from a known contact that you did not expect or discuss first.
• A meeting link sent as a web address, instead of an invite you join through the official Zoom or Teams app.
• A face on screen that does not quite respond to what you say, or seems to loop or repeat.
• Pressure to turn on your webcam early in the call.
• A sudden “technical problem” followed by a request to download, install or update something.
• Any meeting where talk turns to your wallet, your keys or moving funds.

The FBI’s FaceStealer page on FBI.gov gives two clear defenses. Keep your webcam off until you have confirmed who invited you. And join meetings through the official Zoom or Teams app with an invite code, not through a web link. The full list of red flags and defensive steps is in the FBI’s FLASH alert itself.

If you lost a large amount or your business was hit, it may help to talk with a lawyer about your options. For questions about debts or credit damage that follow, a nonprofit credit counselor can help.

Be careful after any loss. People who were robbed of crypto are often contacted by strangers who promise to recover the money for a fee. Never pay anyone to get your money back.

How to report it

The FBI asks victims to report to its Internet Crime Complaint Center at ic3.gov. Use the keyword “FaceStealer” in your report so it reaches the right investigators.

If your identity or personal accounts were used, you can also report and get a recovery plan at IdentityTheft.gov.

You can report fraud to the Federal Trade Commission at ReportFraud.ftc.gov.

You can also contact your state attorney general’s consumer protection office.

If money moved through your bank or card, call your bank or card issuer using the number on the back of your card.

Keep notes on the invite, the account it came from, the time of the call and anything you installed. Do not delete messages before you report. They can help investigators connect your case to others.

For the background, see our crypto scams and regulation guides.

Written byLeah BrennanStaff writer, consumer alerts

Leah writes US Financer's Consumer Alerts: scam warnings and money rule changes issued by federal agencies, state attorneys general, regulators and courts. Each alert starts from the official notice, says what is confirmed and what is not known yet, and lists the agency's own page…

Fact-checked byRuth AdlerStandards Editor

Ruth is US Financer's standards editor. Every article goes through her checks before and after it is published: each rate, fee, cap, deadline and rule is matched against its primary source, every law named is linked to its official text, and anything that cannot be…