WASHINGTON, D.C. — North Korean state-sponsored hackers have siphoned more than $400 million in cryptocurrency over the past 18 months using advanced social engineering tactics, including secretly recorded webcam footage and artificial intelligence-generated deepfakes, according to the FBI.
In an advisory issued on Thursday, November 12, federal authorities detailed a sophisticated cyber campaign dubbed “FaceStealer.” The scheme relies on compromised social media and communication accounts belonging to trusted contacts of the targets.
Victims receive video chat invitations from individuals they have previously interacted with, luring them onto fraudulent versions of popular conferencing platforms such as Zoom, Microsoft Teams, and Google Meet.
Once the victims join the call, they encounter a simulated technical glitch that prompts them to click an external link to resolve the issue. Doing so immediately infects their computers and compromises their own social media and communication accounts. The attackers then harvest the victims’ webcam videos to target their personal and professional networks using the same method.
According to a subsequent update on Wednesday, the FBI has successfully identified and seized more than 900 victim webcam videos linked to the operation.
Investigators noted that the hackers have also begun deploying artificial intelligence to generate convincing deepfake videos of prominent figures within the cryptocurrency and blockchain sectors to enhance their schemes.
The cyberattacks have been attributed by the FBI to a cluster of North Korean threat actors known as “Sapphire Sleet” or UNC1069. Federal officials clarified that this group operates separately from the hackers linked to the recent $6.3 billion breach of the cryptocurrency exchange Binance.