Why North Korea Wants the Money
"The North Korean regime relies on proceeds from large-scale cryptocurrency theft to fund its illicit weapons program, stealing billions of dollars in recent years," said FBI cyber director Brett Leatherman. The announcement comes a week after the world's largest crypto exchange, Binance, revealed that hackers had used fake job interviews to steal a record $6.3bn (£4.7bn). US law enforcement agencies pointed to North Korea-linked actors for that attack, which is thought to be the largest crypto hack to date. Pyongyang has denied the claim.
How the Scam Works
Authorities say FaceStealer "aggressively targets" people working in the cryptocurrency and web3 sectors, especially those who build and maintain open-source software. According to the FBI and the US Justice Department, the hackers use fake or hijacked social media accounts to invite potential victims to video calls hosted on "imposter versions" of Zoom, Microsoft Teams and Google Meet.
During the call, the hackers play pre-recorded videos of earlier victims the target knows, to make the meeting look real, except the audio appears to malfunction. A message then pops up asking the target to "fix" the audio by clicking a link. That "fix" downloads malware onto the device, giving the hackers access to the victim's contact lists and apps and widening the pool of people they can target. The hackers also secretly record these calls and use the footage to scam new victims.
A Warning From the FBI
The FBI has described FaceStealer as "a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user." Patrick Grandy, assistant director in charge of the bureau's Los Angeles field office, said in a statement on Thursday that it "exploits our trust in ubiquitous video conference platforms and valued personal relationships." He added a blunt warning: "If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
