---
title: FaceStealer TTPs: meeting invites from hijacked contacts, replayed webcam video of real victims, and a fake 'can't hear you' fix that installs malware | ctxsec
url: https://ctxsec.com/items/hunt-fbi-facestealer-fake-meeting-fix-lure-recorded-webcam-deepfake
description: "Per DOJ and the FBI: invites come from accounts stolen from earlier victims; once the target joins, the actors record the target's webcam and play prerecorded video of known contacts (or deepfakes of well-known crypto/web3 figures); they then fake a technical error, such as the target not being heard, and supply a link or prompt to 'fix' it that installs malware. Actors then mine contact lists, social media and messaging apps for the next targets, and in several cases stole crypto or hijacked accounts months to over a year after the initial compromise."
status: "official TTPs (DOJ release and FBI FaceStealer page, Nov 12, 2026)"
published: 2026-11-12
---

> Per DOJ and the FBI: invites come from accounts stolen from earlier victims; once the target joins, the actors record the target's webcam and play prerecorded video of known contacts (or deepfakes of well-known crypto/web3 figures); they then fake a technical error, such as the target not being heard, and supply a link or prompt to 'fix' it that installs malware. Actors then mine contact lists, social media and messaging apps for the next targets, and in several cases stole crypto or hijacked accounts months to over a year after the initial compromise.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-fbi-facestealer-fake-meeting-fix-lure-recorded-webcam-deepfake.md)

official TTPs (DOJ release and FBI FaceStealer page, Nov 12, 2026)

2026-11-12 7:40 PM ET

### FaceStealer TTPs: meeting invites from hijacked contacts, replayed webcam video of real victims, and a fake 'can't hear you' fix that installs malware

- **Detect:** meeting-related 'fix' downloads or pasted commands right after a call; new video-conference lookalike domains in DNS/proxy logs; messaging or social accounts sending meeting links the owner didn't send.
- **Scope:** on a confirmed victim, assume long dwell time: rotate wallet keys, repo tokens and SSH keys, and review account sessions going back months.
- **Source of record:** the FBI FLASH linked from fbi.gov/facestealer.

Sources: [DOJ: Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency (Nov 12, 2026)](https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency) · [FBI: FaceStealer Cryptocurrency Theft Scheme](https://www.fbi.gov/facestealer)