> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# FBI warns of FaceStealer fake Zoom and Teams calls
- URL: https://stackurity.ai/blog/fbi-facestealer-fake-zoom-teams-calls-north-korea-crypto-theft/
- Published: 2026-11-14T19:35:04.000Z
- Updated: 2026-11-14T19:35:04.000Z
- Description: The FBI says North Korean attackers use fake Zoom and Teams calls to infect targets. Here is how to spot it and what to rotate if you joined one.
- Author: Stackurity Research Team
- Tags: Linux Servers, News

**TL;DR:** The FBI warned on November 12 about FaceStealer, a North Korean scheme that lures people into fake Zoom and Teams calls, infects their computer and records them. Treat unexpected meeting invites from strangers as hostile, especially if you work in crypto or maintain open-source software.

## What happened

Help Net Security [reported](https://www.helpnetsecurity.com/2026/11/13/fbi-north-korean-fake-zoom-calls/) that state-backed attackers are inviting targets to video meetings where the other "participants" are played back from recorded video of people hit before. The scheme has been named FaceStealer by the FBI. A successful call infects the visitor's machine and captures their own video, which then feeds the next round of fake calls. The FBI directed its warning at crypto and web3 workers and at open-source maintainers.

The weak point is people, not a software flaw, so there is no patch to apply and no version to look up.

## Am I affected?

You are most exposed if you handle crypto assets, publish packages or hold commit rights on projects others depend on. Warning signs are an unsolicited meeting invite, pressure to join quickly, a request to install a "meeting client" or update, and participants who never speak or whose video looks looped. Defences are practical: join only from links you verified through a second channel, install conferencing software only from the vendor's own site, and keep signing keys and tokens off machines used for meetings. If someone already joined a suspicious call, isolate that computer and rotate every key and token stored on it.

## How to check with Stackurity

Be clear about the limits: a social engineering campaign is not a vulnerability in installed software, so Stackurity does not detect FaceStealer itself. It helps with the damage you can control. Stackurity finds keys, tokens and passwords written in files on your servers and repositories and lists where they are, never their values, so you know what to rotate after a suspected infection. See the [remediation documentation](https://stackurity.ai/docs/remediation) for how fixes are tracked. Stackurity Cloud has a 14-day trial: [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=linux-servers&utm%5Fcontent=fbi-facestealer-fake-zoom-teams-calls-north-korea-crypto-theft).