North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months by luring people into fake Zoom and Teams calls filled with stolen webcam video of people they know, the FBI said Thursday, Nov. 12. The bureau calls the scheme FaceStealer. In the same announcement, the Justice Department said it had seized the cloud servers behind it and won court approval to seize or restrain more than $1.2 billion in crypto taken from the Binance exchange last month.
The FBI also took more than 900 recordings of victims' webcams under a federal warrant. The bureau says the same group is now going after people who maintain open-source software, where one compromised maintainer could push malicious code to millions of users.
How a FaceStealer call works
It starts with someone who has already been hacked. The attackers take over that person's Telegram or another messaging account, then use the chat history to message their contacts with an invitation to "catch up" or talk about an investment. A scheduling link follows. Shortly before the meeting, the target gets a link that looks like Zoom or Teams but points to a lookalike domain the hackers registered, such as uu01webzoom.us or teams.livemeet.us.
Inside the fake meeting, the hackers play the earlier victim's recorded webcam footage, often alongside other recorded faces, so the call appears full of familiar people. The target's own camera is being recorded from the moment they click. Then a message pops up, supposedly from the friend. Nobody can hear you, it says. The suggested fix is to click an update prompt, run a script or paste a command into the computer's terminal. That installs malware that captures keystrokes, screens and browser cookies and opens a back door.
The new victim becomes the next lure. According to the FBI's FLASH alert, the hackers have sometimes waited months, and in some cases more than a year, before emptying a wallet, watching the balance grow first.
Security companies track the group under several names, among them BlueNoroff and APT38. The FBI says it has started using what the bureau calls super intelligence to make deepfake videos of well-known crypto figures from public photos and clips, though stolen victim video is still the main tool.
The open-source near miss
Earlier this year, the FBI says, the hackers drew the maintainer of a major JavaScript library onto a fake Teams call with several apparent participants, including one he recognized. He followed the "corrective" steps he was given and infected his own computer. The attackers then used his access to slip malicious dependencies into the library, which gets tens of millions of downloads a week.
Quick detection stopped it. The bureau says it knows of several other attempts against maintainers of widely downloaded packages on npm and, more recently, Rust crates.
How to avoid a fake meeting
The FBI's FaceStealer page and alert give specific steps:
- Join calls through the official Zoom or Teams app with the meeting code instead of clicking a web link, especially when the invite comes from someone you rarely hear from.
- Keep your camera off until you can see and talk to the person who invited you.
- Never run a script or paste code into a terminal to fix a meeting problem. Update the app separately.
- Be suspicious of calendar invites that leave out the meeting link and a link that shows up only minutes before the call.
- Confirm the meeting through a different channel, such as a phone call or text if the invite came on Telegram.
- Turn on multifactor authentication and login alerts in messaging apps such as Telegram and WhatsApp, and use expiring messages so a hijacked account exposes less history.
- Keep only small amounts in browser extension wallets. Larger holdings belong on a separate hardware wallet or with an exchange, and seed phrases should never sit on your devices.
Anyone who thinks they were hit should first move their crypto to a new wallet with a new seed phrase, created on a device that never talked to the hackers. The FBI's alert says the hackers have come back for wallets long after the first break-in, so an old seed phrase is not safe. After that, change passwords and log out every session on messaging and developer accounts. Tell your contacts, and your employer if work files were on the device, then file a report with IC3 using the keyword "FaceStealer."
$1.2 billion of the Binance haul seized or restrained
Separately, the department said the North Korean unit the FBI calls TraderTraitor stole more than $6 billion in digital assets from Binance on or about Oct. 29, a theft Edit USA covered when the FBI named the group. Government and industry efforts have since frozen more than $2.7 billion of it. Prosecutors have court authorization to seize or restrain more than $1.2 billion of that amount.
"The Criminal Division quickly and efficiently used its expertise to immediately halt about half of this historic breach," said Assistant Attorney General A. Tysen Duva, who leads the department's Criminal Division.
The hackers are still moving the rest through bridges, mixers and exchanges, the department said, and the FBI, Secret Service and IRS Criminal Investigation are working to trace it.
