North Korean hackers steal $400M in crypto through fake calls
What's the story
North Korean state-sponsored hackers have stolen over $400 million in cryptocurrency by using fake video calls to impersonate people, US authorities have said. The scheme, dubbed FaceStealer by the FBI, has targeted more than 900 victims in the last 18 months. "The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program," Brett Leatherman, FBI cyber director said.
Targeted industries
How the FaceStealer scheme works
The FaceStealer scheme specifically targets those working in the cryptocurrency and web3 sectors, especially those developing and maintaining open-source software.
According to the FBI and US Justice Department, hackers behind this operation use fake or hijacked social media accounts to lure potential victims into video calls on "imposter versions" of Zoom, Microsoft Teams, and Google Meet.
Deceptive tactics
Hackers use pre-recorded videos of previous victims to dupe targets
During these video calls, the hackers play pre-recorded videos of previous victims known to the target, creating a false sense of legitimacy.
The audio is deliberately made to malfunction. A message then pops up on the target's screen, asking them to "fix" this issue by clicking on a link.
This action secretly downloads malware onto their device, giving hackers access to their contact lists and apps for potential future attacks.
Warning issued
'Think creatively' to avoid falling prey to such attacks
The FBI has described FaceStealer as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user."
Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office, warned that this scheme exploits trust in video conference platforms and personal relationships.
He advised people to think creatively about possible scenarios where they could fall prey to such attacks.