North Korean hackers used fake video calls to steal $400m in crypto, FBI says
US authorities say the FaceStealer scheme has ensnared more than 900 victims in 18 months by luring them into bogus meetings on imposter versions of Zoom, Microsoft Teams and Google Meet.
By Luana Sato ·
State-sponsored hackers from North Korea have stolen more than $400 million in cryptocurrency by using fake video calls to steal people's identities, US authorities have said.
According to the FBI, more than 900 victims have fallen prey to the scheme, which the bureau calls FaceStealer, over the past 18 months.
"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," said FBI cyber director Brett Leatherman.
The disclosure comes a week after Binance, the world's largest crypto exchange, revealed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn) from the company. US law enforcement agencies attributed that breach, believed to be the largest crypto hack to date, to North Korea-linked actors. Pyongyang has denied the claim.
Authorities say the FaceStealer operation "aggressively targets" people who work in the cryptocurrency and web3 sectors, particularly those involved in the development and maintenance of open-source software.
According to the FBI and the US Justice Department, the hackers use fake or hijacked social media accounts to invite potential victims into video calls hosted on imposter versions of Zoom, Microsoft Teams and Google Meet.
Once a target joins, the attackers play pre-recorded videos of previous victims the person is acquainted with, simulating a legitimate call in which the audio appears to malfunction.
A message then pops up on the target's screen asking them to fix the audio by clicking on a link. Doing so eventually downloads malware onto the device, giving the hackers access to the victim's contact lists and apps and widening their pool of potential targets. The calls are also secretly recorded, with the footage used as material to scam new victims, US authorities said.
The bureau has described FaceStealer as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user".
"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office, said in a statement on Thursday. "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
