North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months. They did so by impersonating trusted contacts through fake video meetings and secretly recording victims’ webcam footage, the Federal Bureau of Investigation (FBI) said on November 12, as US authorities moved to disrupt the cybercrime operation.
The scheme, identified as “FaceStealer”, uses compromised social media and communication accounts to send convincing invitations to video calls. The hackers impersonate contacts familiar to their targets, exploiting personal and professional relationships to gain access to cryptocurrency holdings and computer systems.
The FBI said the operation had targeted people in the cryptocurrency and Web3 industries, while increasingly attempting to compromise individuals involved in developing and maintaining open-source software.
Also Read: US revokes over 6,000 visas linked to birth tourism, State Department says
Fake Zoom, Teams calls used to install malware
According to the Justice Department’s November 12 announcement, hackers send invitations through accounts previously stolen from victims. During the meetings, they play prerecorded webcam footage of people the target recognises, creating the impression that trusted contacts are participating.
The attackers then introduce a fake technical problem, such as an audio malfunction, and instruct the target to click a link or follow troubleshooting steps.
The supposed fix secretly installs malware on the victim’s computer, allowing hackers to steal cryptocurrency, access communication accounts and exploit other connected systems.
The compromised victim’s contacts and webcam recordings subsequently become material for further attacks, expanding the network of potential targets.
The FBI said it had seized more than 900 webcam videos of victims under a federal warrant. Hackers have also begun using artificial intelligence-generated deepfake videos of influential figures in the cryptocurrency and blockchain sectors to make the deception more convincing.
US disrupts hacking infrastructure, warns software developers
The Justice Department said it had seized cloud-based infrastructure used in the FaceStealer campaign, which investigators linked to hacking groups including Sapphire Sleet and UNC1069.
FBI officials warned that the operation was no longer limited to cryptocurrency theft, with hackers increasingly targeting open-source software supply chains in attempts to compromise developers and repository accounts.
The agency’s November 12 cybersecurity advisory outlines the scheme and provides guidance for individuals and organisations on recognising suspicious video invitations and avoiding malicious troubleshooting instructions.
The FaceStealer operation is separate from another North Korean-linked cryptocurrency theft involving Binance. In that case, the FBI attributed a theft exceeding $6 billion to a group it calls TraderTraitor.
The Justice Department said US authorities had obtained court authorisation to seize or restrain more than $1.2 billion in cryptocurrency connected to the Binance breach, with efforts to trace and recover the assets continuing.