North Korean state-backed hackers have stolen more than US$400 million (approximately RM1.7 billion) in cryptocurrency over the past 18 months by secretly recording people’s images and using them to trick their contacts, the FBI has warned.
The cybercriminals reportedly use a social engineering operation known as “FaceStealer”, in which victims are lured into video calls through fake versions of popular meeting platforms such as Zoom, Microsoft Teams and Google Meet.
According to the FBI, the attackers send invitations using accounts belonging to genuine contacts whom the victims have previously communicated with.
However, those accounts have already been compromised, allowing hackers to secretly record the individuals’ images and use their identities to approach other targets.
Once victims join the video calls, they are presented with what appears to be a technical error requiring them to click a link to resolve the problem.
Clicking the link infects their computers and compromises their social media accounts, giving hackers access to their contacts and allowing the scam to spread to more people.
The FBI said it had identified and seized more than 900 webcam videos belonging to victims as part of its investigation, according to an advisory issued on Wednesday.
Authorities also warned that the hackers were increasingly using artificial intelligence to create deepfake videos featuring well-known and influential figures in the cryptocurrency and blockchain industries.
These manipulated videos could make fraudulent approaches appear more convincing by impersonating trusted personalities within the digital asset sector.
The FBI attributed the cyberattacks to a North Korean hacking group known as “Sapphire Sleet”, also identified as UNC1069.
The group is separate from other North Korean-linked hackers implicated in the recent US$6.3 billion cryptocurrency theft involving exchange Binance.
The latest warning highlights how cybercriminals are combining stolen identities, fake video meetings and artificial intelligence to target cryptocurrency users and steal digital assets.
