FaceStealer TTPs: meeting invites from hijacked contacts, replayed webcam video of real victims, and a fake 'can't hear you' fix that installs malware
- Detect: meeting-related 'fix' downloads or pasted commands right after a call; new video-conference lookalike domains in DNS/proxy logs; messaging or social accounts sending meeting links the owner didn't send.
- Scope: on a confirmed victim, assume long dwell time: rotate wallet keys, repo tokens and SSH keys, and review account sessions going back months.
- Source of record: the FBI FLASH linked from fbi.gov/facestealer.
Sources: DOJ: Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency (Nov 12, 2026) · FBI: FaceStealer Cryptocurrency Theft Scheme