North Korean state-backed hackers have stolen more than $400 million in cryptocurrency over the past 18 months using a sophisticated online deception scheme involving fake video meetings, according to the US Federal Bureau of Investigation.
The FBI says the campaign, known as “FaceStealer”, relies on impersonating people whom victims already know and trust. Attackers first compromise social media or communication accounts belonging to genuine contacts. They then use those identities to send invitations to video calls through platforms resembling Zoom, Microsoft Teams and Google Meet.
During the meeting, victims are shown what appears to be a technical problem and are instructed to click a link to fix it. The link can install malicious software on their devices, potentially allowing attackers to access accounts and steal sensitive information. The compromised contacts may then be used to target further victims.
According to the FBI, investigators have identified and seized more than 900 webcam videos associated with the campaign. The agency also warned that hackers are increasingly experimenting with artificial intelligence to create deepfake videos of influential figures in the cryptocurrency and blockchain industries.
The warning highlights how cybercrime is evolving beyond traditional phishing emails and suspicious downloads. Criminals are increasingly using familiar faces, realistic digital interactions and artificial intelligence to make fraudulent requests appear legitimate.
Security experts advise users to verify unexpected meeting invitations through a separate communication channel and avoid downloading software or clicking links simply because someone on a video call asks them to do so.
