North Korean hackers have stolen over $400 million in cryptocurrency through a sophisticated scheme involving fake video calls, according to the FBI. The bureau calls the operation FaceStealer, which has targeted more than 900 victims in the last 18 months. The hackers use imposter versions of popular video conferencing platforms like Zoom, Microsoft Teams, and Google Meet to trick their victims. They play pre-recorded videos of people the target knows, then prompt them to click a link to 'fix' the audio, which downloads malware onto the victim's device.
The malware allows hackers to access contact lists and apps, expanding their pool of potential victims. The FBI describes FaceStealer as a highly effective social engineering scheme that can deceive even experienced technical users. 'It exploits our trust in ubiquitous video conference platforms and valued personal relationships,' said Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office.
This latest scheme comes a week after the world's largest crypto exchange, Binance, revealed a record $6.3 billion hack, which US authorities also attributed to North Korea-linked actors. Pyongyang has denied involvement in both incidents. The FBI's cyber director, Brett Leatherman, stated that the North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program.