North Korean hackers stole more than $400 million in crypto over the past 18 months by luring people into fake video calls and tricking them into installing malware, the U.S. Justice Department said in its announcement. In several cases, the hackers waited months to more than a year after infecting a computer before stealing crypto and taking over communications accounts.
The FBI calls the scheme FaceStealer. Hackers target people who work in crypto and related technology.
- Hackers send meeting invitations from accounts taken over from earlier victims.
- During the call, hackers play recorded video of people the target knows. They also use AI-generated videos of well-known figures in crypto.
- Hackers claim the target cannot be heard and offer a link or prompt to fix the supposed audio problem.
- The supposed fix installs malware that lets hackers steal crypto or use the target’s access to other computer systems.
It exploits our trust in ubiquitous video conference platforms and valued personal relationships.
Patrick Grandy, head of the FBI’s Los Angeles field office
Hackers secretly record the new target’s webcam video for use in later calls. They access contact lists, social media and messaging apps to find more people to approach. Under a federal warrant, the FBI seized more than 900 webcam videos of FaceStealer victims. The Justice Department announced the seizure of cloud-based infrastructure used in the scheme.
The Justice Department said the hackers have increasingly targeted people who develop and maintain open-source software, seeking access to their devices and software repository accounts. The department said that targeting appears calculated to enable attacks through software that other people and companies use.
The FBI has published guidance on protecting against FaceStealer and steps for people whose computers have been compromised.
