---
title: No real video call needs you to install a 'fix': verify invites out of band and hang up on audio-error prompts | ctxsec
url: https://ctxsec.com/items/tip-facestealer-never-run-a-meeting-fix-verify-invites-out-of-band
description: "FaceStealer works because the invite comes from a real contact's account and the 'contact' on screen is a recording."
status: "guide (based on the DOJ and FBI FaceStealer disclosures, Nov 12, 2026)"
published: 2026-11-12
---

> FaceStealer works because the invite comes from a real contact's account and the 'contact' on screen is a recording.

[← Tips & Guides](/tips) · [markdown](/items/tip-facestealer-never-run-a-meeting-fix-verify-invites-out-of-band.md)

guide (based on the DOJ and FBI FaceStealer disclosures, Nov 12, 2026)

2026-11-12 7:40 PM ET

### No real video call needs you to install a 'fix': verify invites out of band and hang up on audio-error prompts

- Confirm unexpected meeting invites through a different channel than the one they arrived on, even from people you know.
- Only join meetings in the vendor's installed app or its real domain; never install software or paste commands offered mid-call to fix audio or video.
- Maintainers: use hardware-key MFA on repo accounts and keep publishing credentials off the machine you take calls on.

Sources: [DOJ: Justice Department Announces Actions to Disrupt North Korea's Massive Theft of Cryptocurrency (Nov 12, 2026)](https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-north-koreas-massive-theft-cryptocurrency) · [FBI: FaceStealer Cryptocurrency Theft Scheme](https://www.fbi.gov/facestealer)