North Korean hackers steal over $400 million in crypto using fake Zoom calls, FBI says

The operation, dubbed FaceStealer by US investigators, primarily targets people working in cryptocurrency and Web3, particularly developers and maintainers of open-source software, the BBC reported on November 13.

The hackers use fake or hijacked social media accounts to invite targets to video meetings on counterfeit versions of popular platforms, including Zoom, Microsoft Teams and Google Meet.

Once the call begins, the attackers play recordings of people the victim knows, obtained from earlier attacks. The footage creates the impression of a genuine conversation — until the audio appears to malfunction.

A message then instructs the target to click a link to fix the sound. Instead, the link leads to malicious software that can give the attackers access to the victim's contacts and applications.

The hackers also secretly record the new victims, allowing them to reuse their identities and video footage in subsequent attacks.

The FBI described FaceStealer as a highly effective social engineering operation capable of deceiving even experienced users who are familiar with cybersecurity risks.

"It exploits our trust in ubiquitous video conference platforms and valued personal relationships," said Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office.

The bureau says North Korea uses proceeds from cryptocurrency theft to finance its weapons programs.

The disclosure follows a separate, much larger cryptocurrency theft. Last week, Binance reported losing approximately $6.3 billion in an attack involving fake job interviews. US authorities attributed that operation to North Korea-linked hackers, an allegation Pyongyang has denied.

The FBI has identified the group behind the Binance attack as TraderTraitor. Authorities say the stolen cryptocurrency may be moved through Ethereum and decentralized finance services to conceal its origins.