North Korea-linked hackers allegedly stole more than $400 million in cryptocurrency through fake video calls.
The operation known as FaceStealer allegedly ensnared more than 900 victims over 18 months and aggressively targeted people in crypto and web3, especially developers and maintainers of open-source software. The scheme allegedly used fake or hijacked social media accounts to invite targets into video calls hosted on imposter versions of Zoom, Microsoft Teams, and Google Meet. Hackers allegedly played pre-recorded videos of acquainted previous victims while making the audio malfunction, then asked targets to fix the audio through a malicious link. The link allegedly downloaded malware, giving hackers access to contact lists and apps and allowing them to record calls for new scams. The method was described as a highly effective social engineering scheme that exploits trust in video platforms and personal relationships.