Can You Still Trust a Familiar Face on a Video Call?
The short answer
Not on its own. On November 12, 2026, the FBI described a campaign that replays real, stolen webcam recordings on fake Zoom and Teams meetings, then uses a staged audio problem to get the target to install malware. Treat a face on screen as one signal, join only through official apps, and confirm any request for money, passwords or software on a second, known channel.
Key takeaways
- Attackers can replay real webcam footage, so a familiar face isn’t proof of identity.
- Never run an “audio fix” or update link from inside a meeting; update the app separately.
- Confirm money, password and software requests on a second channel you already trust.
For years, the advice for spotting a fake email or text was simple: if you’re not sure, get the person on a video call. If you could see their face on Zoom or Microsoft Teams, you could trust it.
That advice needs an update.
On November 12, 2026, the FBI and the Justice Department described a North Korean hacking campaign the FBI calls “FaceStealer.” The attackers send meeting invites from hijacked accounts of people the target already knows, link to look-alike Zoom or Teams pages they control, and play a real, previously recorded webcam video of that contact. Then they claim the target can’t be heard and offer a link, update prompt or command to “fix” the audio. The fix installs malware.
According to the Justice Department, the scheme has led to the theft of more than $400 million in cryptocurrency over the past 18 months, and the FBI seized over 900 webcam videos of victims that were used to impersonate them in later attacks.
This campaign mainly targeted people in cryptocurrency and open-source software. But the tactic itself, a trusted face plus a fake technical problem, works against any business that meets on video. Here’s how to keep your meetings from becoming the easy way in.
Why video calls became a target
A familiar face lowers everyone’s guard
Most teams have learned to be wary of strange email links. Video still feels safe, because you can see who you’re talking to. That’s exactly what this tactic exploits. The FBI notes the attackers overwhelmingly rely on genuine stolen recordings rather than AI deepfakes, which makes the video look even more convincing.
How the “audio fix” works
Based on the FBI’s description, the sequence looks like this:
- A message arrives from a real contact’s account (often on Telegram, LinkedIn, Slack or Discord) suggesting a quick catch-up, usually with a calendar invite.
- The meeting link looks like Zoom or Teams but goes to a copycat site.
- The target sees their contact’s face on screen. The “contact” says they can’t hear the target.
- The target is asked to click an update link, run a script or paste a command to fix the audio.
- That step installs tools that can capture passwords, keystrokes and screens, and give the attacker ongoing access.
No firewall was broken. The attacker simply asked someone to open the door.
Tighten the settings in your meeting software
You don’t need a new security product to close the most obvious gaps. Start with the settings already in your business communications platform:
- Require sign-in for internal meetings. Limit internal meetings to authenticated users from your company domain, so anonymous guests can’t drop in.
- Use a lobby or waiting room for outside guests. External attendees wait until the host admits them.
- Limit chat links and file sharing for guests. Restrict who can post files or links in the meeting chat.
- Make outside guests easy to spot. Teams labels external participants, and similar options exist in other platforms. Make sure staff know what the label looks like.
If your team uses Teams for calling as well as meetings, see our guide to Microsoft Teams calling for how phone lines and meetings fit together under one admin console.
Build a verification habit
Join through the official app, not a link
The FBI recommends joining through the official Zoom or Teams application with a meeting ID or invite code rather than clicking a link to a web version, and checking calendar invites for odd meeting links before you join. It also suggests keeping your webcam off until you can see, hear and talk with the person who invited you.
Never run a “fix” from inside a call
If a meeting tells you to install something, run a script or paste a command, stop. Leave the meeting and update the app through its normal settings or your IT process. A real colleague with a bad microphone can switch to the phone.
Use a second channel for money, passwords and software
Make this a written rule for anyone who handles payments, vendor banking details, passwords or system access:
- Pause the request, even if it came from someone you can see on screen.
- Call the person on a number you already have on file, such as their extension in your company phone system.
- Confirm the request out loud before acting.
The FBI gives the same advice for meetings themselves: confirm a scheduled video call with the person who invited you through a different method than the one used to contact you.
Protect laptops outside the office
Remote and hybrid staff don’t sit behind the office firewall. DNS or web filtering on laptops and home connections can block many known malicious sites, and multifactor authentication with login alerts on messaging accounts makes them harder to hijack in the first place. If you’re reviewing connectivity for a hybrid team, our business internet page covers the options.
Lock the door before someone walks in
A face on a screen is still useful, but it is no longer proof. Tightening your meeting settings and adopting a simple second-channel habit protects your team without making meetings harder for clients.
Cambia Digital can review how your phone and video platforms are set up today, including guest access, meeting policies and how staff verify sensitive requests, and compare options side by side, with no vendor bias.
Sources
Frequently asked questions
In the campaign the FBI described in November 2026, attackers sent invites from hijacked accounts of people the target knew, linked to look-alike Zoom or Teams pages they controlled, and played a recording of the real person’s webcam video. They then claimed an audio problem and pushed a link or command to “fix” it, which installed malware.
Not much. Clients can still join scheduled meetings. A lobby or waiting room means the host admits outside guests, and chat or file-sharing limits stop guests from posting links or files. Most teams find the extra step takes seconds.
Second-channel verification. Never approve a payment, a change to bank details, a password reset or a software install based only on a video call or meeting chat. Confirm it by calling the person on a number you already have on file.
For most small businesses, the account-wide settings (authentication, lobby rules, chat and file-sharing limits) can be reviewed and changed in a single working session. Training staff on the verification habit is the part that takes ongoing attention.