North Korean hackers stole $400M with recorded webcam clips and fake Zoom calls

The face on the other side of the video call belonged to a friend, a colleague or an investor the target already knew. It was a recording. According to the FBI, North Korean hackers have been luring people into imitation Zoom and Teams meetings, playing back webcam footage secretly captured from earlier victims, and then talking the new target into installing malware disguised as a quick technical fix.

The bureau calls the scheme FaceStealer, and it turns the most routine moment of remote work into the attack itself. The invitation comes from a real account belonging to someone you trust, the meeting looks like the app you use every day, and the person waiting for you appears to be exactly who you expected. The FBI says it can fool even experienced, security-conscious users.

The scale is large. In an alert to the cryptocurrency industry and to open-source software maintainers, the FBI says the scheme has stolen more than $400 million in cryptocurrency over the past 18 months. Investigators seized the cloud infrastructure behind it, along with more than 900 webcam videos of victims working in crypto and Web3 around the world, which the hackers kept as a library for impersonating them in later attacks.

Each attack begins with someone who has already been hacked. The attackers take over that person’s Telegram or another messaging app, read the chat history and write to their contacts with tailored invitations to catch up, discuss a collaboration or talk about an investment. A Calendly invite follows, often with no meeting link. The link only arrives shortly before the call, pointing to a lookalike address that opens a copy of Zoom or Teams the hackers control. Inside, the target sees the familiar contact, often with several other participants, all of them prerecorded.

Then comes the trick. A message from the fake contact says the target cannot be heard and points to an update, a script to run or a line of code to paste into the terminal. That fix installs a browser cookie harvester, a keylogger, a screen capturer and a backdoor. The hackers have been recording the target’s webcam since the moment the link was clicked, so the new victim becomes the face that lures the next one. “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough,” said Patrick Grandy, who leads the FBI’s Los Angeles field office.

The risk reaches far beyond crypto wallets. The FBI says the same technique has been aimed at people who maintain widely used open-source code. In one case, the maintainer of a major JavaScript library, downloaded tens of millions of times a week, joined a fake Teams call with someone he recognized, followed the suggested fix and infected his computer. The hackers then used his access to slip malicious dependencies into the library’s downloads before the compromise was caught. The bureau says other attempts have targeted maintainers on npm, the main JavaScript package registry, and more recently Rust developers. One fooled maintainer can put malware in front of millions of people who never joined any call.

Artificial intelligence plays a part, though a smaller one than the headlines about deepfakes might suggest. The FBI says the group has started generating deepfake videos of prominent figures in crypto, which only need to pass as grainy webcam footage. Yet the scheme still overwhelmingly relies on real video stolen from real victims, which means a deepfake detector would not catch most of these calls.

The takedown also leaves a lot unsolved. Servers can be replaced, and the people behind the scheme, attributed by the FBI to the North Korean state hacking group known as BlueNoroff, APT38 or Sapphire Sleet, operate from North Korea, far from the reach of US courts. The FBI has not said how many of the people in the 900 videos lost money. And in several cases the hackers waited months, sometimes more than a year, before emptying a wallet, holding off while its balance grew, so some victims may not yet know their computer is compromised.

The FBI’s advice is concrete. Join meetings through the official Zoom or Teams app with an invite code rather than a web link, especially from new or rare contacts. Keep your camera off until you can see, hear and talk to the person who invited you. Never run a script or paste code into a terminal to fix a call. Be suspicious when a calendar invite arrives without a meeting link and the link shows up minutes before the start, and confirm the meeting through a different channel. Turn on multifactor authentication, login alerts and disappearing messages on Telegram, WhatsApp and Slack.

The FBI published its FaceStealer alert on November 12, the same day the Justice Department announced the seizure. The department also said it has court approval to seize or restrain more than $1.2 billion of the cryptocurrency North Korean hackers stole from the Binance exchange in late October, out of more than $2.7 billion frozen so far, and that work to recover the rest continues. The FBI has set up a dedicated FaceStealer page with guidance for anyone who thinks they have been targeted.

Tags: Cybersecurity, deepfakes, FBI, North Korea, Zoom, FaceStealer