FaceStealer, Deepfakes, and the Courtroom: What Investigators Need to Know

When a video turns up in a case, examiners ask where it came from, whether it has been altered, and whether that work will hold up in court. On November 12, 2026, the U.S. Department of Justice announced actions against what it described as North Korean cryptocurrency-theft schemes, including a campaign the FBI calls FaceStealer. In September, the Arizona Court of Appeals vacated a manslaughter sentence because the judge had relied on an AI-generated video of the deceased victim.

What the Justice Department announced

On November 12, the Justice Department said the U.S. Attorney’s Office for the Central District of California and the FBI’s Los Angeles Field Office had disrupted cloud-based infrastructure used in FaceStealer. According to the Department, the scheme has resulted in the theft of more than $400 million in cryptocurrency in the last 18 months, and the actors have also tried to compromise open-source software maintainers. Pursuant to a federal warrant, the FBI seized over 900 webcam videos of FaceStealer victims. The Department attributed the activity to North Korean actors known publicly as Sapphire Sleet, UNC1069, Dangerous Password, CryptoCore, APT38, BlueNoroff, and Stardust Chollima. The FBI also published a FLASH advisory and, the Department said, created a resource page at fbi.gov/facestealer.

Separately from FaceStealer, the Department said that on or about October 29, members of the North Korean military, referred to by the FBI as TraderTraitor, stole more than $6 billion in virtual assets from Binance. It said U.S. government and private-sector efforts had frozen more than $2.7 billion, and that courts had authorized the seizure or restraint of more than $1.2 billion of that amount. Tracing continues, the Department said, as the actors move assets through cryptocurrency bridges, mixers, and exchanges. BBC News reported that North Korea has denied U.S. attribution of the Binance theft to North Korea-linked actors.

How the scheme worked

This summary follows the Justice Department announcement and the FBI FLASH dated November 12. It is not an independent technical reconstruction.

1. The FBI says a first compromise can include scanning a device for wallets and seed phrases, taking over a Telegram or other encrypted messaging account, collecting contacts and chat history, and secretly recording the person’s webcam.
2. Using that hijacked account — on platforms the FBI says include Telegram, LinkedIn, Slack, and Discord — the actors invite contacts to a video meeting on imposter versions of Zoom, Microsoft Teams, or Google Meet.
3. Once the new target joins, the actors play prerecorded webcam video of the earlier victim. The Department says they also use what the FBI calls “super intelligence” (SI) to generate deepfake videos of well-known people in cryptocurrency and web3, used instead of or alongside real victim video.
4. The actors then introduce a fake technical problem, such as claiming the target cannot be heard, and offer a “fix” that, the Department says, installs malware. The FLASH adds that this may involve an update prompt, a script, or pasted code, and that the malware can eventually install a cookie harvester, keyloggers, screen-capture tools, and a backdoor.
5. With the computer compromised, the actors can steal cryptocurrency or use the victim’s access to other systems, including an employer’s network or a software-repository account. In several reported cases, theft happened months to more than a year later. The actors then use the new victim’s contacts, chats, and newly recorded webcam video to target other people.

What this means for examiners

Video authentication and provenance

The same case may contain genuine recorded webcam video and generated video, sometimes inside a single meeting capture. An examiner’s first job is not to declare a file “real” or “fake” from a screenshot or a single tool score. It is to preserve the original under lawful authority, keep the chain of custody intact, and document where the file was found, along with hashes, timestamps, and the application or path that stored it. Tools that claim to identify deepfakes can be useful as one input, but their output is not a finding and does not prove a recording is what a party says it is. If you use such a tool, document the name, version, settings, and limitations, and look for corroboration outside the video.

Timelines, contacts, and crypto tracing

If the reported loss is recent, the infection may not be. The Department and the FBI describe delays of months to more than a year. Look backward for unusual logins, messaging-app session takeovers, changes to passwords or recovery numbers, and outbound connections around a suspicious meeting. The FLASH notes that hijacked accounts may have recovery information changed and existing sessions closed. Preserve relevant cloud and account logs under lawful process, and do not assume a “date of loss” window is enough. FaceStealer, as described, is also a relationship attack. Treat address books, recent chats, and meeting invites as a map of possible downstream victims, and flag through the case agent that contacts may already have been targeted.

The Binance-related action, which the Department presented separately from FaceStealer, is a reminder that speed and provider cooperation matter. According to the Department, investigators and virtual asset service providers froze more than $2.7 billion after a theft of more than $6 billion, and courts then authorized seizure or restraint of more than $1.2 billion, while actors moved assets through bridges, mixers, and exchanges. Early preservation requests and careful clustering that does not overstate a link both matter. A freeze at an exchange is not a completed forfeiture.

When AI video reaches the courtroom

On September 30, 2026, the Arizona Court of Appeals, in State v. Horcasitas, No. 1 CA-CR 25-0191, affirmed a manslaughter conviction but vacated a 10.5-year sentence and remanded for resentencing. At sentencing, the court heard an AI-generated video in which a likeness of the deceased victim spoke to his family, the court, and the defendant. The sentencing judge described the video as “genuine” and as the victim speaking “from his heart.” The appeals court held that embedded clips of the real victim were permissible, but the AI rendering was not: it did not depict actual events, presented a depiction of the victim and his thoughts “created from the imaginings of the victim’s sister,” and presented those words as coming directly from the victim. The court said no disclaimer could cure that error, and that the judge’s reliance on the video made the sentencing fundamentally unfair (Reuters; Law.com, Nov. 12).

On October 9, 2026, the Iowa Supreme Court, in State v. Amyda, No. 24-1563, affirmed a conviction after the defendant argued that a video should have been excluded as a possible deepfake. The court held that the video was properly authenticated with the victim’s detailed testimony about distinctive characteristics she recognized, and that a deepfake claim without evidentiary support was not enough to keep it out. The two cases do not give examiners a new technical test, but they do show the questions courts are already asking: Is this file a record of a real event, or a generated performance? Was it authenticated with something more than an assertion?

Sources

U.S. Department of Justice, Nov. 12, 2026; FBI FLASH AC-111226-MS; FBI FaceStealer page; BBC News; State v. Horcasitas; Reuters; Law.com; State v. Amyda.