North Korean state-backed hackers have stolen over $400 million in cryptocurrency in the past 18 months through a sophisticated social engineering scheme called FaceStealer, according to the FBI. The scheme involves luring targets to imposter versions of video meeting platforms like Zoom, Microsoft Teams, and Google Meet. Victims receive invitations from compromised contacts whose social media and communication accounts have been hijacked, along with secretly recorded images.
Once on the call, targets encounter a fake technical error that prompts them to click a malicious link. This infects their computer and social media accounts, allowing hackers to target additional contacts. The FBI has seized more than 900 victim webcam videos as part of their investigation.
The FBI has attributed this activity to a group known as Sapphire Sleet or UNC1069, distinct from the hackers linked to the recent $6.3 billion hack of cryptocurrency exchange Binance. The agency also warned that hackers are increasingly using artificial intelligence to create deepfake videos of influential figures in the cryptocurrency and blockchain industries.