The U.S. Federal Bureau of Investigation (FBI) revealed Thursday that North Korean-backed hackers have stolen more than $400 million worth of cryptocurrency over the past 18 months, using a fraudulent scheme involving secretly captured images and videos of individuals to target people they know.
According to the FBI, victims are lured into video calls through fake versions of popular video conferencing platforms, including Zoom, Microsoft Teams, and Google Meet, as part of a scheme known as “Face Stealer.”
How the Hackers Carry Out the Scam
According to an FBI security advisory, targets receive invitations to join video calls from genuine contacts with whom they have previously communicated. However, those contacts’ social media and other communication accounts have already been compromised, allowing hackers to secretly record images of the account owners.
Once victims join the video call, which is also recorded, they are shown a fake technical error message instructing them to fix the problem by clicking on an online link.
Clicking the link infects victims’ computers and compromises their social media accounts. Their contact lists are then used to target new victims, creating a continuous chain of cyberattacks.
The FBI said in an advisory issued Wednesday that it had identified and seized more than 900 video recordings captured through victims’ webcams.
AI and Deepfake Technology Used in Attacks
The FBI warned that hackers have begun using artificial intelligence to create fake videos with deepfake technology, allowing them to impersonate well-known and influential figures in the cryptocurrency and blockchain industries.
North Korean Hacking Group Behind the Attacks
The FBI attributed the activity to a North Korean hacking group known as “Sapphire Sleet,” also identified as “UNC1069.”
The bureau said the group is separate from the North Korean hackers whom the FBI linked to a recent breach of cryptocurrency trading platform Binance, in which digital assets worth $6.3 billion were reportedly stolen, according to the information cited in the report.
