FBI says FaceStealer used fake video meetings to steal over $400 million in cryptocurrency

The FBI attributes FaceStealer to North Korean actors tracked under names including Sapphire Sleet, UNC1069 and BlueNoroff. Attackers take over messaging or social accounts, then approach the victim’s contacts through services such as Telegram, LinkedIn, Slack or Discord. They can use a legitimate scheduling invite and send the fake meeting link just before the call. The imitation meeting can record the new target’s webcam and play genuine footage of earlier victims. The FBI also describes some use of generated deepfakes.

Attackers claim that the target’s audio or software has failed and ask the target to install an update, run a script or paste commands into a terminal. The FBI describes malware that harvests browser cookies, records keystrokes and screens, and leaves a backdoor. Some thefts and account takeovers happened months or more than a year after initial compromise. Attackers can reuse the new victim’s contacts and footage to repeat the process.

The FBI puts theft at more than $400 million over 18 months. It reports more than 900 seized webcam videos, a count of recordings. In one case it describes a maintainer’s device being infected and attackers using the access to create malicious dependencies for an unnamed JavaScript library. The FBI says quick detection and response stopped the attack from becoming widespread and reports other targeting of npm and Rust maintainers. The reported theft and targeting support L4. DOJ announced the disruption of cloud infrastructure on November 12 and addressed the separate Binance theft in the same announcement.