State-sponsored hackers from North Korea have stolen more than $400 million in cryptocurrency by using fake video calls to steal people’s identities, US authorities say. More than 900 victims fell prey to the scheme, which the FBI refers to as FaceStealer, in the last 18 months. This follows a week when Binance revealed that hackers used fake job interviews to steal a record $6.3 billion from the company. US law enforcement attributed that massive hack to North Korea-linked actors, though Pyongyang denied the claim. The current operation targets workers in the cryptocurrency and web3 sectors, particularly those involved in open-source software development.
The Social Engineering Mechanism
FaceStealer operators use fake or hijacked social media accounts to invite potential victims into video calls hosted over "imposter versions" of Zoom, Microsoft Teams, and Google Meet. During these calls, hackers play pre-recorded videos of previous victims whom the target knows, simulating a legitimate conversation while making the audio appear to malfunction. A message then pops up on the screen, asking the user to "fix" the audio by clicking on a link. This action downloads malware onto the device, granting attackers access to contact lists and applications. They secretly record these interactions to use as material for scamming new victims.
Authority Warnings and Impact
FBI cyber director Brett Leatherman stated that the regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years. The bureau describes FaceStealer as a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user. Patrick Grandy, assistant director of the Los Angeles field office, noted that the scheme exploits trust in ubiquitous video conference platforms and valued personal relationships. He warned that if you cannot imagine a scenario where you might fall prey to it, you are not thinking creatively enough. The operation clearly demonstrates how easily deep familiarity with digital tools fails against sophisticated impersonation tactics.
