FBI says North Korean hackers used fake video calls in $400m crypto theft - Saudi Gazette
US authorities say state-sponsored North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months using a sophisticated social engineering scheme.
The scheme, known as FaceStealer, uses fake or hijacked social media accounts to invite potential victims into video calls hosted on imposter versions of Zoom, Microsoft Teams, and Google Meet.
Once on the call, hackers play pre-recorded videos of previous victims the target is acquainted with to simulate a legitimate conversation, except that the audio would appear to malfunction.
A message then pops up on the target's screen, asking them to "fix" the audio by clicking on a link, which eventually downloads malware onto their device.
"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years."
The malware allows hackers to access the victim's contact lists and apps, widening their pool of potential targets. The FBI has described FaceStealer as a highly effective social engineering scheme.
The agency warns that the hackers would secretly record these calls and use the recordings as material to scam their new victims.
"It exploits our trust in ubiquitous video conference platforms and valued personal relationships."
The FBI says the campaign "aggressively targets" those who work in the cryptocurrency and web3 sectors, particularly those involved in the development and maintenance of open-source software.
This comes a week after the world's largest crypto exchange Binance revealed that hackers had used fake job interviews to steal a record $6.3 billion from the company.
US law enforcement agencies attributed the Binance hack to North Korea-linked actors, a claim that Pyongyang has denied.
Related
