North Korean state hackers have reportedly stolen more than $400 million in cryptocurrency over the past 18 months. The FBI refers to this scheme as 'FaceStealer', which has resulted in at least 900 impersonation victims.
The hackers utilize fake versions of popular video conferencing platforms such as Zoom and Microsoft Teams to carry out their operations. They hijack victims' accounts on platforms like Telegram, LinkedIn, Slack, and Discord to lure contacts into fake meetings.
During these fake meetings, the hackers play recorded webcam footage of previous victims and instruct new victims to run updates or scripts that install malware on their devices. The malware includes cookie harvesters, keyloggers, screen capturers, and backdoors.
The FBI has observed attempts against maintainers of open-source software, including JavaScript libraries and Rust crates. Additionally, the hackers have started creating deepfakes of well-known crypto figures to further their scheme.
The FBI has seized more than 900 recordings of victims used in the scheme. The hackers are known to wait from a few months to over a year before emptying the wallets of their victims.