North Korean hackers stole more than $400 million in cryptocurrency over 18 months by impersonating trusted people during video calls, according to The Hacker News. The scheme matters beyond large crypto companies because it can begin with a convincing invitation from a real contact whose account was previously hijacked.
What happened
The campaign, called FaceStealer, used stolen accounts to invite targets to online meetings. During a call, the attackers could show prerecorded webcam footage of someone the target knew or a deepfake of a prominent person in the cryptocurrency industry.
A few seconds into the meeting, the victim would see a fake technical problem claiming that their audio was not working. The supposed repair link was actually intended to install malware, steal cryptocurrency and give the attackers access to other computer systems, according to The Hacker News.
The operation also targeted communications and social accounts, including Telegram, LinkedIn, Slack and Discord. Attackers could remain in a compromised account, examine its contacts and use that trusted identity to approach more victims.
The FBI seized cloud infrastructure connected to the campaign as well as more than 900 webcam recordings that could have been used for later impersonation attempts. The seizure may disrupt part of the operation, but the source does not say that every server, stolen account or malware installer has been removed.
Who is affected
The reported targets were primarily people working in cryptocurrency and Web3, plus developers and maintainers of open-source software. That includes freelancers, investors and small-office employees who take business calls or manage digital assets from home.
Anyone receiving an unexpected meeting invitation from a known contact should still be cautious. A familiar face, voice or account is not enough to prove that the person controlling the call is genuine.
What to do now
Leave calls that demand a software “fix.” Do not open a link, paste a command or install an update supplied through the meeting chat. Call or text the person using a phone number you already had to confirm the invitation.
Use official update controls. For Zoom, Teams or another meeting app, open the installed app’s Settings or Help menu and select its update option. Do not update through a pop-up presented inside an unexpected meeting.
Check important accounts for unfamiliar sessions. Open the Security or Devices page in Telegram, LinkedIn, Slack and Discord. Sign out unknown devices, then change the password from a device you trust. Use a different password for every account and enable two-factor authentication or a passkey where available.
Treat a clicked repair link as a possible infection. Disconnect that computer from Wi-Fi or Ethernet, stop using it for cryptocurrency or account recovery, and run a full scan with updated security software. Change sensitive passwords from a separate, trusted device.
Warn contacts if your account was used. Tell them which meeting invitations or links were fake and ask them not to install anything. Review recent messages and active sessions before returning the account to normal use.
Sources
- FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls — The Hacker News
Written by the CyberSec24 news desk with AI assistance, from the sources above. Spot an error? Tell us and we'll correct it.