What happened
Help Net Security reported today on the FBI's warning about 'FaceStealer', a scheme the FBI attributes to North Korean state hackers (tracked as Sapphire Sleet, BlueNoroff and APT38, among other names) that has stolen more than $400 million in cryptocurrency over the past 18 months. The attackers take over earlier victims' Telegram, LinkedIn, Slack and Discord accounts, message their contacts about catching up or an investment, set a time with a Calendly invite, and shortly before the call send a meeting link pointing to a lookalike domain such as uu01webzoom[.]us. In the fake call they play recorded webcam video of the contact and other 'participants', then claim the target cannot be heard and walk them through an update, script or terminal command that installs a cookie harvester, keyloggers, a screen capturer and a backdoor while the webcam records them for use against the next victim. The FBI has seized more than 900 such recordings. The FBI advises keeping the webcam off until you can see, hear and talk with the inviter, joining through the official Zoom or Teams app with an invite code, confirming invitations through a second channel, never running scripts or pasting code to fix a meeting app, keeping only small amounts in browser extension wallets, and moving funds to a new wallet created on a clean device if compromise is suspected.
How the scam works
Crypto phishing and draining sites ask you to connect a wallet, sign a transaction, 'claim' a token, or paste a recovery phrase. Once you approve the request, the operator can empty the wallet. Address-poisoning works differently: the operator sends dust or zero-value transfers from a look-alike address so that, later, a hurried copy-paste from the transaction history goes to them instead of to the address you meant. Always check every character of an address, and never connect a wallet or enter a seed phrase on a site you reached from a message, a pop-up or a look-alike URL. Official wallet and exchange brands named in a lure are not involved.
Source
Source: https://www.helpnetsecurity.com/2026/11/13/fbi-north-korean-fake-zoom-calls/
