North Korean Hackers Steal Millions in Cryptocurrency

North Korean hackers have stolen over $400 million in cryptocurrency by pretending to be friends and colleagues in fake video calls, according to the FBI. The hackers hijack messaging accounts and use webcams to record people, then trick their contacts into downloading malicious software.

The hackers use fake versions of Zoom, Microsoft Teams, and Google Meet. They exploit familiar faces and fake technical glitches to access computers. This operation, known as “FaceStealer,” has been ongoing for 18 months, stealing more than $400 million. Agents have seized computers and over 900 webcam recordings.

How Does FaceStealer Work?

The FBI outlines six stages of the scam. Each victim can lead the hackers to additional targets.

Stage 1: Compromising the First Victim

Hackers target someone whose computer is already compromised. They search for cryptocurrency wallets and passwords, access contacts and messages, and secretly record the webcam while waiting for a video call.

Stage 2: Hijacking Messaging Accounts

The hackers take over accounts on platforms like Telegram, LinkedIn, Slack, and Discord. They pose as the account holder to arrange video calls, often discussing projects or investment opportunities. The hackers use previous messages to make invitations seem convincing.

Stage 3: Setting Up Fake Video Calls

Hackers use legitimate scheduling services like Calendly to set meetings. Before the call, the target receives what appears to be a Zoom or Teams link. However, the link leads to a fake video site controlled by hackers.

Stage 4: Playing Secretly Recorded Footage

When targets join, they see recorded footage of friends or colleagues. Hackers may play multiple recordings to appear as though others are attending the meeting.

Stage 5: Tricking Victims Into Installing Malware

Hackers create a fake technical issue, like a microphone malfunction. Posing as a trusted contact, they instruct the person to download an update or run code, thus installing malware. This allows hackers to steal information, record keystrokes, and capture screenshots.

Stage 6: Repeating the Attack

With access to a victim’s computer, hackers can steal cryptocurrency, hijack accounts, and contact contacts. They repeat the process with each new victim. Sometimes hackers wait months or a year before stealing cryptocurrency, allowing wallet balances to grow.

Hackers Also Use Deepfake Videos

Hackers have begun using AI-generated videos to impersonate cryptocurrency industry figures. They create fake appearances using public photos and recordings. But, the scheme mainly relies on genuine webcam footage from previous victims.

The FBI has identified and seized over 900 recordings in the scheme. Patrick Grandy, an FBI assistant director, said, “It exploits trust in video conference platforms and personal relationships.”

Millions More Could Have Been Exposed

Hackers also targeted developers of popular software. Earlier this year, they compromised a developer of a widely used JavaScript library. The developer was tricked into a fake Teams meeting and told to fix a technical problem. Hackers then created malicious components that could have been distributed with legitimate downloads. The attack was detected before causing widespread harm.

What Has the FBI Done?

The Justice Department announced seizing cloud-based infrastructure used in FaceStealer. The scheme is attributed to North Korean state-sponsored hackers, known as Sapphire Sleet, BlueNoroff, and Stardust Chollima. U.S. officials say North Korea uses cryptocurrency theft to fund its weapons program.

How Do You Know If You’ve Been Targeted?

The FBI warns that unexpected video invitations, even from known contacts, could be scams. A warning sign is being told to install software or click links during a call. The agency advises joining meetings through official apps using codes and confirming invitations through another communication method. Keep webcams off until the other person is verified.

If you suspect your computer is compromised, secure accounts, change passwords, and warn contacts. Move cryptocurrency to a new wallet on an untouched device. Report suspected FaceStealer activity to the FBI at IC3.gov with the keyword “FaceStealer.”

Contact Newsweek editors on this story: Rebecca Flood and Emma Lee-Sang.