The FBI has stated that state-sponsored hackers from North Korea have stolen more than $400 million in cryptocurrency by using fake video calls to steal identities. The bureau refers to this scheme as FaceStealer, which has affected more than 900 victims over the last 18 months.
FBI cyber director Brett Leatherman said the North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years. This report follows a week-old revelation by Binance, the world's largest crypto exchange, that hackers used fake job interviews to steal a record $6.3bn (£4.7bn) from the company. US law enforcement agencies attributed that hack to North Korea-linked actors, though Pyongyang has denied the claim.
Authorities say FaceStealer "aggressively targets" people working in the cryptocurrency and web3 sectors, specifically those involved in developing and maintaining open-source software. According to the FBI and the US Justice Department, hackers use hijacked or fake social media accounts to invite victims into video calls hosted on "imposter versions" of Google Meet, Microsoft Teams, and Zoom.
The hackers then play pre-recorded videos of previous victims the target knows to simulate a real call, while making the audio appear to malfunction. A message then appears on the target's screen asking them to "fix" the audio by clicking a link. This link downloads malware onto the device, allowing hackers to access apps and contact lists to find more victims. The US authorities say hackers secretly record these calls to use as material to scam new targets.
The FBI described FaceStealer as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user." Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office, said in a statement on Thursday that the scheme exploits trust in video platforms and personal relationships. Grandy added, "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
