Key facts
- The FBI attributed the activity to a North Korean hacker cluster it calls Sapphire Sleet, also known as UNC1069.
- Targets receive invitations from genuine contacts whose social media and communication accounts were compromised and whose images were secretly recorded.
- On the call, targets encounter a mock technical error requiring a link click that infects their computer and social media accounts.
- The FBI said hackers are starting to use artificial intelligence to create deepfake videos of well-known cryptocurrency and blockchain figures.
- The FBI said Sapphire Sleet is a separate group from North Korean hackers it linked to the $6.3 billion Binance hack.
North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months using surreptitiously recorded images of people, which are then used to target their contacts, the FBI said on November 12, 2026.
The FBI calls the social engineering method FaceStealer. Targets are lured to video chats on imposter versions of video meeting software including Zoom, Microsoft Teams and Google Meet, according to the FBI.
Invitations come from genuine contacts the targets have previously interacted with, but whose social media and communication accounts have been compromised and whose images have been secretly recorded, the FBI said.
Once on the call, the targets, who are also being recorded, encounter a mock technical error that requires a fix by clicking a link, which then infects the target's computer and social media accounts. The target's contacts are then used to target additional people.
The FBI said it identified and seized more than 900 victim webcam videos, according to an advisory dated November 11, 2026.
Hackers are starting to use artificial intelligence to create deepfake videos of well-known and influential people in the cryptocurrency and blockchain industries, the FBI said.
The FBI attributed the activity to a cluster of North Korean hackers known as Sapphire Sleet or UNC1069, a separate group from the North Korean hackers linked by the FBI and private industry to the recent $6.3 billion hack of cryptocurrency exchange Binance.