North Korean hackers are using stolen webcam recordings to impersonate crypto workers in fake meetings with their contacts, turning one victim’s familiar face into bait for the next attack, the FBI warns.
The Justice Department announced disruption of cloud-based infrastructure used in FaceStealer on November 12. It said the scheme had caused more than $400 million in cryptocurrency theft over the preceding 18 months and that the FBI had seized over 900 victim webcam videos under a federal warrant.
The DOJ release treats FaceStealer separately from the Binance theft, which CryptoSlate has covered through the FBI’s attribution and the exchange’s asset-replenishment delays.
A familiar account opens the door
In its November 12 FLASH advisory, the FBI describes attackers taking over genuine accounts on services including Telegram, LinkedIn, Slack and Discord. Access to chat histories lets them tailor an invitation to earlier conversations, giving a new approach the context of an existing relationship.
A legitimate calendaring service can handle the scheduling. The malicious meeting link arrives shortly before the call, directing the target to a copycat Zoom or Microsoft Teams session controlled by the attackers.
Once the target enters, stored webcam footage makes it appear that the known contact has joined. Attackers can simulate several participants. The familiar person on screen can therefore be a real prior victim’s recording, rather than a live participant.
The FBI says FaceStealer still overwhelmingly relies on stolen genuine videos. Generated deepfakes provide an additional way to impersonate participants.
The target’s webcam becomes part of the attack before the supposed troubleshooting begins. The FLASH says recording starts when the target first clicks the imposter meeting link. The attackers can later use that footage to impersonate the target.
During the meeting, an attacker claims there is an audio or other technical problem. The proposed remedy can be an update prompt, a script or code to paste into a terminal. Following the instructions installs malware, which the FBI says can include tools for harvesting browser cookies, logging keystrokes, capturing screens and maintaining access to the device.
That is where the scheme joins theft to impersonation. Access to the computer can expose cryptocurrency or other valuable access. Stolen communication accounts, contact lists and webcam footage give the hackers material for the next approach. The FBI’s FaceStealer resource page describes the same cycle of compromise, account hijacking and fake meetings.
The damage is not necessarily immediate. The FBI reported cases in which cryptocurrency theft and communication-account takeovers came months to more than a year after the initial compromise. A quiet period after a suspicious meeting therefore does not establish that a device or account is safe.
Opening the imposter meeting link records webcam footage; following the fake fix installs malware.
The cycle shows reuse, not a fixed timetable or every encounter. The FBI says genuine stolen footage predominates, while generated deepfakes are also used.
Check the invitation before trusting the face
The FBI recommends using the official meeting application with an invite code and, where possible, confirming an invitation through a different communication channel. That checks the approach beyond the account the attacker may already control.
It also advises delaying webcam activation until the inviter can be seen, heard and communicated with. An apparent technical fault should not lead to running scripts or pasting terminal code presented as a video-client update.
For people who suspect compromise, the bureau recommends securing cryptocurrency in a new crypto wallet created on an unaffected device, securing communication and developer accounts, alerting contacts and employers, and reporting to IC3 with the keyword FaceStealer. Alerting contacts can interrupt further approaches that could reuse the stolen account and recording.
