FBI links fake video-call scheme to more than $400m in crypto theft

In a warning issued on 12 November, the FBI said the campaign, which it calls FaceStealer, had stolen more than $400 million in cryptocurrency over the previous 18 months. It attributed the activity to North Korean state-sponsored hackers. The warning did not explain how the figure was calculated or set out the full basis for the attribution.

The US Justice Department said authorities had disrupted cloud infrastructure used in the scheme. The FBI also seized more than 900 webcam videos of victims under a federal warrant.

Nieuws.nl described the 900 videos as deepfakes. The FBI, however, identifies them as victim webcam recordings and says the scheme still relies overwhelmingly on genuine footage. It says the hackers have also begun using AI-generated deepfakes of prominent people in the cryptocurrency industry. The figure refers to videos, not a count of people who lost money.

According to US authorities, attackers send invitations from accounts taken over from previous victims. Targets are directed to imitation Zoom or Microsoft Teams meetings, where recordings make it appear that a trusted contact has joined. A supposed fix for an audio or other technical problem then installs malicious software, giving the attackers access to cryptocurrency or other systems. The new victim’s footage and contacts can be used to approach others.

The FBI said the campaign had also targeted developers of open-source software. In one case, it said, hackers used a maintainer’s access to add malicious components to a widely used JavaScript library, but the compromise was detected before it spread widely.

Cybersecurity firm JUMPSEC reported in July that it had examined code behind a similar fake-meeting kit. It attributed the campaign it studied with high confidence to BlueNoroff, a North Korea-linked group.

Separately, the Justice Department said it had obtained court authorisation to seize or restrain more than $1.2 billion of the funds frozen after the October Binance hack. The FBI attributed that theft to a different North Korean group; North Korea denied involvement in the Binance attack.

The FBI advises people to use official meeting apps with invitation codes, confirm unexpected invitations through another channel and avoid running scripts or pasting code into a terminal to perform a supposed update.