North Korea Steals $400 Million via Fake Video Calls
FBI says more than 900 victims lost cryptocurrency in a scheme that used hijacked accounts to lure workers into malicious video conferences.
By Martin Reynolds ·
North Korean hackers stole more than $400 million in cryptocurrency over the last 18 months by tricking victims into joining fake video calls, US authorities announced Thursday. The FBI identified the operation as FaceStealer and reported that at least 900 people fell for the scheme. Brett Leatherman, the FBI cyber director, stated that the North Korean regime uses proceeds from these thefts to fund its illicit weapons program. He noted that the country has stolen billions of dollars in recent years.
This disclosure comes one week after Binance, the world's largest crypto exchange, revealed that hackers stole a record $6.3 billion. US law enforcement attributed the Binance hack to North Korea-linked actors, a claim Pyongyang denied. Authorities say the FaceStealer group aggressively targets workers in the cryptocurrency and web3 sectors. The hackers specifically focus on individuals involved in the development and maintenance of open-source software.
The FBI and the US Justice Department describe the method used to deceive these technical professionals. Hackers use fake or hijacked social media accounts to send invitations to video calls hosted on imposter versions of Zoom, Microsoft Teams, and Google Meet. During the call, the hackers play pre-recorded videos of people the target already knows. The audio in these calls appears to malfunction, creating a sense of urgency.
A message then appears on the target's screen, asking them to fix the audio by clicking a link. This action downloads malware onto the device. The software gives hackers access to the victim's contact lists and apps. This access widens the pool of potential victims. The hackers secretly record these interactions and use the footage to scam new targets.
The FBI described FaceStealer as a highly effective social engineering scheme. The bureau said the method can deceive even the most experienced and security-conscious computer users. Patrick Grandy, the assistant director of the FBI's Los Angeles field office, issued a statement on Thursday. He said the scheme exploits trust in ubiquitous video conference platforms and valued personal relationships.
Grandy added that if users cannot imagine a scenario where they might fall prey to the hack, they are not thinking creatively enough. The announcement details the mechanics of the attack and the specific targets of the North Korean group.
The FBI and Justice Department released the information on Thursday. The report outlines the timeline of the thefts and the specific tools used by the hackers to compromise devices.
