Fake video calls linked to more than US$400 million in cryptocurrency theft

The FBI says hackers linked to North Korea have stolen more than US$400 million in cryptocurrency over an 18-month period by drawing targets into fake video calls. The campaign, described as FaceStealer, has reportedly affected more than 900 people.

People working in cryptocurrency and Web3 are the main targets. The attackers use imitations of familiar calling services, including Zoom, Microsoft Teams and Google Meet, to make the invitations and calls look credible.

During a call, the target is told that an audio problem needs fixing and is encouraged to open a suspicious link. The apparent request for technical help is the point at which the attackers try to get the person to take an unsafe step.

The link is used to install malicious software on the computer. This gives the attackers access to contact lists and applications, extending the damage beyond the deceptive call itself.

US authorities also say the calls are secretly recorded. The recordings are then reused to deceive other people, allowing material taken from one interaction to help the attackers approach new targets.

The warning is not limited to inexperienced internet users. Even people with technical knowledge and cybersecurity experience can be caught by this method. The advice is to avoid opening links supplied during suspicious video calls, including links presented as a quick fix for sound problems.