FBI FLASH says FaceStealer relies on genuine stolen video: none of its 6 stages names super intelligence

None of the FLASH's six stages names super intelligence (derived)

On 12 November 2026 the FBI released FLASH AC-111226-MS, marked TLP:CLEAR, on a North Korean social engineering scheme it calls FaceStealer. It describes the scheme in six numbered stages. Searching each stage's text for super intelligence (SI), AI and deepfakes finds 0 of the 6 (derived count, by this site). The only place the FLASH puts deepfakes is a separate section after Stage 6, which says the scheme currently continues to overwhelmingly rely on the theft of genuine victim videos. The Summary does not mention SI at all.

The Department of Justice release of the same day sets a different tone. Its subtitle reads "Super Intelligence-Enabled Social Engineering Campaign" and its text says the scheme "relies on surreptitiously recorded videos and artificial deepfakes". The FLASH never uses the abbreviation AI and does not define SI beyond the words "super intelligence (SI)"; this site uses the FLASH's term and says where it means deepfake video.

What this does not establish. It does not show that deepfakes are absent: the FLASH says the actors "have begun to use super intelligence (SI)" and credits one security company for contributions on SI use and deepfake production. It gives no count of deepfake meetings, no tool or model, and no account of how the FBI knows. It also gives no victim count: the 900 is a count of videos, not people. Everything marked "not stated" below is as read from the saved FLASH and DOJ release at 07:20 UTC on 13 November 2026; either could be updated within the hour. The DOJ announcement also covered a seizure of Binance related assets, which this briefing does not cover; this site has a separate briefing on that half.

What the FLASH says happens, stage by stage

The FLASH is a seven page PDF. Its "Technical Details" section walks one cycle of the scheme. The table gives each stage as the FLASH prints it, a close paraphrase of what the stage text says is used, and whether that stage's own text names SI or deepfakes. It never does.

Zoom

The sound problem. In Stage 5 the pretext is that the target cannot be heard by everyone in the session. This site's inference, not the FLASH's: a recording cannot answer, so the claim of an audio fault also explains why the faces on screen do not respond. That makes "you cannot be heard" a cue to leave the call, not to fix anything.

Named brands. The FLASH says the fake meetings imitate Zoom, Microsoft Teams and Google Meets, that Calendly invites are used, and that accounts on Telegram, LinkedIn, Slack and Discord have been hijacked. These are brands imitated or accounts taken over, and the FLASH does not allege fault on the part of any of them.

A headline word and a body that weighs it differently

Three documents use three weights for deepfakes. The table sets them side by side, with the FLASH's own page placing the passage.

The friendly label. "Super intelligence" is a label doing the work of a finding. The FLASH gives no volume of deepfake use, no model or tool, no sign of what happened to a target who met a deepfake, and it calls video generation only "one of the more concerning ways" the actors use SI without listing the others. What it does say is a quality bar: deepfakes only need to be "good enough to pass as webcam video".

Why the weighting matters to a defender (inference). A control built to spot synthetic faces addresses the optional part. The load bearing part, on the FLASH's own account, is a genuine recording of a genuine contact, played on a genuine account that the hackers have taken over. A deepfake detector would have nothing to flag in that recording. The FLASH says as much: its best practices "should assist potential targets regardless" of which kind of video the hackers use.

Workers or videos. The FLASH title says "900+ Tech Workers". The body says the FBI "identified and seized over 900 victim webcam videos". Whether one person appears in more than one video, and whether every person worked in technology, is not stated. The audience the FLASH names is people in the cryptocurrency and web3 industry and open-source software maintainers.

The numbers on the page, and what each leaves out

The FLASH carries four numbers that readers will repeat. The ledger gives each in the FLASH's words, what the page does not say about it, and what this site worked out.

Zoom

900 videos, and the grid. The FLASH's Figure 1 is a grid of redacted, blurred thumbnails that the caption calls examples of the 900. Counted by eye in the PDF's embedded image, it is 8 rows of 15, 120 thumbnails (derived: 8 x 15), so at most 13.3 percent of 900 (derived: 120 / 900 = 0.133, and "over 900" makes it a ceiling). This site has not reproduced the figure. A dollar per video ratio is not computed, because the page gives no victim count.

$400 million and 18 months. The FLASH says more than $400 million in cryptocurrency over the past 18 months. Counting 18 calendar months back from the 12 November 2026 release gives 12 May 2025 (derived); the FLASH does not say when the 18 months start. More than $400 million over 18 months is more than $22.2 million a month on average (derived: 400 / 18 = 22.2), but the average assumes an even spread, and the FLASH says the thefts followed compromises by "months to over a year after the initial compromise". A theft over a year after compromise may therefore trace to a machine infected before the window opened (inference). The page does not say whether any money was recovered.

Months to over a year. The FLASH says that in several reported cases the hackers stole cryptocurrency and hijacked accounts after that wait, while balances in wallets grew. It does not say how many cases. The FBI's advice follows from it: a seed phrase copied once can be used later, so moving funds to a new wallet with a new phrase matters more than the date of the original compromise.

The near miss in a JavaScript library

The FLASH says the hackers have mainly used FaceStealer to steal cryptocurrency, and have also aimed it at software developers and maintainers. It says that earlier this year they nearly turned one maintainer into a route to "very large-scale victimization". In its account, the hackers lured the maintainer of a significant open-source JavaScript library into a fake Teams chat that appeared to hold several participants, including at least one person the maintainer recognised. The maintainer was told something was wrong, followed the "corrective" steps and was infected. The hackers then used the maintainer's access to create malicious dependencies that would be downloaded with legitimate library downloads. The library receives tens of millions of downloads per week, and the FLASH says quick detection and response stopped it.

The FLASH adds that the FBI knows of several other attempts on maintainers of libraries with significant download volume, multiple attempts against maintainers on the JavaScript registry the FLASH prints as "Node Packet Manager (NPM)", and, recently, against maintainers of Rust crates. The DOJ release says the hackers have "increasingly" targeted open-source work and that this targeting appears calculated to enable software supply chain attacks.

Not stated. The library's name. The month. Whether any malicious dependency was published to a registry, or downloaded by anyone: the FLASH calls the attack failed and says the dependencies would have been downloaded, which leaves the reached stage open. Who detected it, how, and how long the hackers held the maintainer's access. The FLASH does not name the library and this site does not guess.

Where the FLASH and the DOJ release differ

The two documents were issued on 12 November 2026. The DOJ release carries press release number 26-1356 and says the FBI published the FLASH the same day. They agree on the actors, the $400 million and the 18 months. They differ in emphasis and in what each says about the seizure.

Neither document says whether the seized videos came from the seized infrastructure, and the FLASH does not say how the videos were obtained. The DOJ release quotes the head of the FBI's Los Angeles Field Office saying the scheme can deceive experienced, security conscious users, and that anyone who cannot imagine falling for it is "not thinking creatively enough". That is an official's view and this site does not test it.

What the FLASH states, and what it does not

Who wrote what. The FBI wrote the FLASH. Its technical sources are three security companies it names, Arctic Wolf, Jumpsec and Microsoft Threat Intelligence Center (MSTIC), whose reports it says hold lists of indicators of compromise. They sell security services and are credited here, not accused. This site has not read those three reports, which are listed in the sources: Arctic Wolf, Jumpsec and Microsoft. The FLASH's administrative note says the FBI endorses no commercial entity.

What to do, in order

First the FBI's recommendations from page 5, in close paraphrase and labelled FBI. Then five items this site adds, labelled this site. The five are this site's suggestions and are not in the FLASH.

The FBI's first and third items differ slightly on web versions: the first says use the app and an invite code rather than clicking links to web versions, and the third allows joining the web version with the invite code. Both put the invite code in your own hands rather than a link from a chat message.

Technical details

The FLASH prints two domains, six stage names, a one line payload description and a few account hijack and timing details. It prints no hashes, IP addresses, file names, commands or detection rules, and says the three vendor reports hold the indicators. Each block below is copied from the FLASH, with dots in brackets added by this site to the domains and apostrophes straightened.

Two typo-squatted domains. The FLASH calls these "North Korean controlled typo-squatted domains" used for fake Zoom and Teams links. A defender searches DNS, proxy and mail logs for lookups or clicks and blocks them. Derived from the two strings: both sit under the .us suffix, one puts a meeting product's name inside a longer unrelated name, and the other puts the product's name in front of an unrelated registered name. Read the registered name from the right, not the left words. This site has not visited or resolved either domain.

uu01webzoom[.]us
teams[.]livemeet[.]us

The marking, number and six stage names. Use these to cite the FLASH correctly and to map an incident to a stage when reporting.

TLP:CLEAR
FLASH Number AC-111226-MS
12 NOVEMBER 2026
Stage 1: The Compromise of Victim A
Stage 2: Exploitation of Victim A's Telegram Account or other ECA
Stage 3: Use of Legitimate Services and Creation of Imposter Video Chat Sessions
Stage 4: Exploiting Victim A's Secretly Recorded Video Image
Stage 5: Social Engineering the Target to Self-Infect
Stage 6: Repeat the Cycle and Return to Stage 1

Payload, link timing and account hijack. The FLASH describes the Stage 5 malware only in one phrase and names no family. The timing line is why a calendar invite with no link is normal for this scheme, and the hijack line is what to look for in a messaging app's session list and recovery settings.

Malware installed by the Stage 5 "fix" (as printed): browser cookie harvester, keyloggers, screen capturers, and a backdoor
Link timing (as printed): North Korean hackers frequently do not include video chat links in their scheduling emails, instead sending malicious video chat links closer to the appointed meeting date and time.
Account hijack method (as printed): The hackers will hijack the accounts by logging onto the account from a different device, changing the recovery account such as the recovery phone number, then closing your sessions.

How to report. The FLASH asks for reports at IC3.gov with the keyword below, and for local FBI field offices to be contacted for suspicious activity.

Report at: IC3.gov
Keyword: FaceStealer
Include (as printed): date, time, location, type of activity, number of people, type of equipment used, name of the submitting company or organization, designated point of contact

The question the FLASH leaves open

The FBI's first defence is to wait until you can see, hear and speak with the person who invited you, and its central finding is that the face on the screen is often a real recording of a real colleague on a real account. If that face were genuine and the person were not there, which of your team's checks would be the first to fail, and who would notice?

Key facts