North Korean cyber units use fake video calls in $400 million crypto theft, FBI warns

North Korean state-sponsored cybercriminals have pilfered upwards of $400 million in cryptocurrency across the past year and a half by deploying covert video recordings of individuals to deceive their contacts, the Federal Bureau of Investigation warned.

According to an advisory released by the bureau, the operation relies on an elaborate social engineering tactic dubbed "FaceStealer." Victims are enticed into joining online calls hosted on fake platforms designed to imitate well-known conferencing applications such as Zoom, Google Meet, and Microsoft Teams.

The invitations appear legitimate because they are sent from compromised communication and social media profiles belonging to people the victims already know. Unknown to the participants, the accounts have been breached and previous visual footage of the real account holders has been secretly captured.

During these fraudulent video conferences, the attackers secretly record the new participant while triggering a simulated technical glitch. Meeting attendees are told they must click a provided link to resolve the issue. Instead of fixing the problem, clicking the link deploys malicious software that infects the computer and hijacks the victim's own social media profiles. Those newly compromised credentials and recorded likenesses are subsequently leveraged to ensnare more individuals in the target's network.

Federal investigators revealed that they have tracked down and seized upwards of 900 webcam recordings taken from victims so far. The FBI pointed out that the perpetrators have also begun integrating artificial intelligence technology, generating deepfake footage depicting prominent figures and executives across the cryptocurrency and blockchain sectors to enhance their credibility.

The FBI has linked the illicit campaign to a specific cluster of North Korean state hackers tracked as "Sapphire Sleet," also designated as UNC1069. Agency officials clarified that this network is distinct from the North Korean cyber unit that government investigators and cybersecurity researchers previously tied to the massive $6.3 billion breach of the Binance digital currency exchange.