The call starts normally. You see a familiar face, maybe two or three other people in tiles next to it. Then a message pops up in the chat: they can't hear you. Here's a quick fix, just paste this into your terminal.
That's the whole trick behind FaceStealer, a North Korean campaign the US Justice Department says is behind more than $400 million in crypto theft over the last 18 months. On November 12, prosecutors in California disrupted its cloud infrastructure, and the FBI seized more than 900 webcam recordings of victims under a federal warrant.
If you maintain a package, hold keys or have push access to anything that other people install, this one is aimed at you.
How the attack works
The FBI published a FLASH alert with the full chain. Simplified:
- One person gets infected. The attackers search their machine for wallets and seed phrases, take over their Telegram or another messenger, read the chat history and quietly record their webcam.
- Their contacts get invited. From the hijacked account, the attackers write to people the victim already talks to: catch up, collaborate, talk about an investment. The messages borrow details from real conversations. They also use new or stolen accounts on LinkedIn, Slack and Discord.
-
The link changes at the last minute. A Calendly invite sets the time. Shortly before the call, a link arrives to a lookalike Zoom or Teams page. Two domains named in the alert:
uu01webzoom.usandteams.livemeet.us. - The meeting is staged. The "participants" are recordings of earlier victims, sometimes with a fake waiting room in front.
- You run the payload yourself. Someone reports an audio problem and asks you to install an update, run a script or paste a command. That installs a cookie stealer, keylogger, screen capture and a backdoor, and your webcam starts recording.
- You become the next lure. Your face, your accounts and your contacts feed the next round.
Two details stood out to me. First, the attackers sometimes waited months, even more than a year, for a wallet balance to grow before draining it. Second, deepfakes are in the mix now, but most of the footage is real video of real victims. As the FBI put it, a fake only needs to be good enough to pass as webcam video.
Why maintainers are on the list
The FBI says the campaign targets open-source developers and maintainers, especially on npm and the Rust crates registry, to get into their devices and repository accounts. One maintainer of a widely used JavaScript library was nearly compromised through a fake Teams call earlier this year. The FBI says quick detection stopped it from turning into a large incident. The library isn't named.
You don't have to imagine what a successful version looks like. On March 31, the npm account of the axios maintainer was compromised and two malicious versions, 1.14.1 and 0.30.4, were live for about three hours. They pulled in a dependency called plain-crypto-js, which used a postinstall hook to drop a backdoor for Windows, macOS and Linux. The affected lines usually see more than 100 million downloads a week. Google's threat intelligence team attributed it to UNC1069, one of the names the FBI now lists behind FaceStealer. Google didn't say how the account was taken over, so I won't pretend to know it was a fake call. The point is what one compromised maintainer can reach.
The same idea, at exchange scale
North Korea's Binance attack last month followed a similar path, through a person rather than a protocol. According to Binance's November 3 post-mortem, a fake recruiter contacted a software engineer in September and sent a "second-round" coding assignment. It carried malware that replaced a legitimate pyenv component. In October the attackers used that machine and an internal AI tool to reach two engineers on the wallet infrastructure team, found a container deployment token, and on October 29 deployed a container that reached the wallet signing service.
ChangeNOW's breakdown of the $6.3 billion Binance hack covers what happened next on-chain, including how one EIP-7702 delegation out of 50 signed attempts gave the attacker control of a major hot wallet. It also has a line I keep coming back to, from AMLBot CEO Viacheslav Demchuk: a transaction can be cryptographically valid without being operationally authorized.
To be fair to the facts: an FBI agent told The Record it's unclear whether FaceStealer itself was used against Binance. These are two operations. They just share the same entry point, a developer who was asked to run something.
What I'd change in my own setup
The FBI's advice is short and sensible. I've added a few dev-specific items on top.
On calls
- Join Zoom or Teams through the official app with a meeting ID, not a link, especially with people you haven't spoken to in a while.
- Keep the camera off until you've confirmed who's on the other side.
- Confirm the meeting through a different channel. A quick voice message or a call works.
- Never run a script or paste a command to "fix" audio. Leave, update the app yourself, rejoin.
On your machine and accounts
- Treat take-home tasks from recruiters like untrusted code. Run them in a throwaway VM or container, never on the laptop that has your keys and tokens.
- Look at install scripts before they run.
npm ci --ignore-scriptsskips them, andnpm query ":attr(scripts, [postinstall])"lists dependencies that have apostinstallscript. - Use 2FA on publishing for npm and crates.io, ideally with a hardware key, and keep tokens scoped and short-lived. If your registry supports publishing from CI only, use that.
- Turn on login alerts and disappearing messages in your messengers. A hijacked Telegram is how the next victim gets invited.
On crypto
- Keep only small amounts in browser extension wallets.
- Don't store seed phrases or private keys on the device you code on.
If you think you ran something
The FBI says to create a new wallet with a new seed phrase on a clean device and move funds right away, then reset passwords, end all sessions and warn your contacts. That move is where people rush and paste the wrong thing. Copy the new address from the new wallet, not from transaction history, check the network and send a small test amount first. This guide to swapping common pairs safely has a good section on address poisoning, including a case where the test transfer worked and the main one still went to a lookalike address.
Then report it at IC3.gov with the keyword "FaceStealer".
One more thing
The quote from the FBI's Los Angeles office that stuck with me:
"If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
I'd add a smaller rule for myself: nobody on a video call gets to tell me what to paste into my terminal.
Sources
Top comments (0)