The FBI has disrupted a sophisticated cryptocurrency theft scheme called FaceStealer, attributed to North Korean hackers. The scheme targets professionals in the cryptocurrency and Web3 industries, as well as developers of open-source software.
The scheme operates through social engineering tactics, including impersonating trusted contacts via hijacked Telegram or LinkedIn accounts. Victims are lured into fake Zoom or Microsoft Teams meetings, where their webcam footage is secretly recorded. The hackers then use this footage to impersonate the victim in subsequent meetings, creating a convincing deception.
During the fake meetings, victims are tricked into downloading malware under the guise of fixing a technical issue. This malware grants the hackers access to the victim's computer, cryptocurrency holdings, and social media accounts. The cycle continues as the hackers use the stolen information to target the victim's contacts.
Jeremy Robertson, special agent in charge of Cyber and Counterintelligence at FBI Los Angeles, emphasized the effectiveness of the scheme, noting that even experienced crypto executives and cybersecurity experts have fallen victim. The FBI has provided resources to help individuals protect themselves and their contacts from this ongoing threat.