The FBI revealed that a hacker group backed by the North Korean government uses video calls via Zoom and Microsoft Teams to trick victims into stealing personal data and installing malware, siphoning off more than $400 million in cryptocurrency from over 900 victims.
The U.S. Federal Bureau of Investigation (FBI) disclosed that a hacker group linked to the North Korean government employs a new scam involving fake video calls to steal victims’ identities and information before stealing digital assets, or cryptocurrency, amounting to over $400 million, approximately 13 billion baht, with more than 900 victims over the past 18 months.
The FBI calls this scam operation "FaceStealer," which targets those working in the cryptocurrency and Web3 industries, especially developers and maintainers of open-source software.
The scam begins with hackers using fake or stolen social media accounts to contact victims and invite them to join video meetings through fake platforms mimicking Zoom, Microsoft Teams, and Google Meet.
The attackers then play video clips showing other victims known to the target, creating the appearance of a genuine conversation with acquaintances. During the call, audio problems occur, followed by a message prompting the victim to click a link to fix the sound issue.
When victims trust and click the link, malware is downloaded onto their devices without their knowledge, allowing hackers to access contact lists and various apps to expand their target network and deceive others.
Officials also found that hackers secretly record video call conversations’ images and audio to use these clips as trust-building tools to deceive new victims.
Bret Leatherman, FBI Cyber Division Director, stated that the North Korean government relies on large-scale cryptocurrency thefts to fund illegal weapons programs, having stolen several billion dollars in digital assets over the years.
Patrick Grandy, Assistant Director of the FBI’s Los Angeles office, warned that this scam is highly effective because it exploits the trust people place in widely used online meeting platforms and personal relationships, making even those knowledgeable about technology and cybersecurity vulnerable.
This development comes just a week after Binance, the world’s largest cryptocurrency exchange, revealed it was hacked by attackers impersonating job applicants and tricking interviewers, stealing digital assets valued at up to $6.3 billion. U.S. law enforcement believes the hackers are linked to North Korea, while the Pyongyang government denies the allegations.
:BBC
Click to read related newsInternational News