The FBI's Los Angeles Field Office has issued a warning about a sophisticated cryptocurrency theft scheme called FaceStealer, orchestrated by North Korean hackers. The scheme targets workers in the cryptocurrency and Web3 industries worldwide, using fake video conferencing platforms like Zoom and Microsoft Teams to deceive victims.
Over the past 18 months, the FaceStealer scheme has resulted in more than $400 million in crypto thefts and at least 900 impersonation victims. The hackers hijack Telegram and LinkedIn accounts to lure contacts into imposter meetings, where they secretly capture webcam videos to impersonate victims later.
Special Agent Jeremy Robertson of the FBI Los Angeles Field Office explained that during these fake meetings, victims are tricked into downloading malware under the guise of fixing technical issues. This malware grants hackers access to victims' computers, crypto assets, and social media accounts, enabling them to repeat the cycle with the victims' contacts.
The FBI and the U.S. Department of Justice disrupted a cloud-based infrastructure linked to the hackers, uncovering over 900 victim videos. The victims include experienced crypto/Web3 executives, developers, and even cybersecurity experts. The hackers have also targeted individuals involved in open-source software development to access their devices and digital storage spaces.