FBI says North Korean hackers used fake video calls in $400m crypto theft

Detailed summary

State-sponsored North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months by using fake video calls ...

WASHINGTON — State-sponsored North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months by using fake video calls to obtain people's identities which are then used to target them, US authorities said on Thursday.

"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," says FBI cyber director Brett Leatherman.

This comes a week after the world's largest crypto exchange Binance revealed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn) from the company.

US law enforcement agencies attributed the Binance hack, thought to be the largest crypto hack to date, to North Korea-linked actors. Pyongyang has denied this claim.

Authorities say FaceStealer, the latest scheme, "aggressively targets" those who work in the cryptocurrency and web3 sectors, particularly those who are involved in the development and maintenance of open-source software.

According to the FBI and US Justice Department, FaceStealer hackers use fake or hijacked social media accounts to invite potential victims into video calls hosted over "imposter versions" of Zoom, Microsoft Teams, and Google Meet.

Next, the hackers play pre-recorded videos of previous victims the target is acquainted with to simulate a legitimate call – except that the audio would appear to malfunction.

A message then pops up on the target's screen, asking them to "fix" the audio by clicking on a link. This "fix" would eventually download malware onto the target's device, which allows hackers to access their contact lists and apps, widening their pool of potential victims.

Hackers would secretly record these calls and use the recordings as material to scam their new victims, according to the US authorities.

Opening of the article, excerpted from Saudi Gazette. To read the rest, open the article on the publisher's site.