The FBI is warning that a North Korean hacking scheme has been using fake video calls and malware to steal people's identities and scam more victims.
The "FaceStealer" campaign has targeted at least 900 people, federal officials told journalists in a Thursday briefing. “Pursuant to a federal warrant, the FBI seized over 900 webcam videos of FaceStealer victims,” the Justice Department said.
It’s long been known that North Korean state-sponsored hackers use fake job interviews, as they did in the $6.3 billion Binance breach, to trick victims into installing malware. However, the FBI is warning that North Korea's state-sponsored group APT 38, also known as Bluenoroff, has developed a savvy way to perpetuate the hacking to other victims.
The hackers use fake or hijacked LinkedIn, Telegram, Slack, and Discord accounts to send messages to potential victims. The North Koreans impersonate a trusted contact, business acquaintance, or a figure from the cryptocurrency industry. Their messages will also look legit by including personal details that the potential victim has revealed in conversations with others.
The hackers will then send an invite to a video call to catch up. The video calls will be hosted over lookalike domains for Zoom, Microsoft Teams, or Google Meet. Once the call starts, the victim will see the impersonated trusted contact or acquaintance appear on the call, except there will be no audio. A message will eventually appear in the video call asking the victim to fix the audio error by visiting a link to install an update. But in reality, the link will download malware to the victim’s computer.
The FBI noted: "The hackers often include multiple fake participants in the Zoom/Teams sessions to add pressure on the target to 'correct' a problem only they are seeming to have."
Once it infects a device, the malware will not only look for and steal cryptocurrency from the victim's accounts but also steal password details, browser cookies, and information from the victim’s contact list, thus giving the North Koreans more people to target. At the same time, the North Koreans can exploit the web camera footage in the video call to steal the victim's identity, and replay the footage in future scams, or further manipulate it using AI-powered deepfakes.
The FBI estimates that the FaceStealer campaign netted the North Korean hackers “more than $400 million worth of cryptocurrency” in the last 18 months. Although the attackers have mainly been targeting people involved with cryptocurrency, investigators warn that the hackers have also been going after programmers in the open-source software community, enabling North Korea to secretly tamper with open-source software projects to widely infect other users.
The FBI said in one case: "The hackers used multiple interactions to lure a significant open-source JavaScript library into a fake Teams video chat. The hackers made it appear that there were multiple participants in the Teams session, including at least one individual the maintainer recognized... If not for the quick detection and response to the compromise, the failed attack could easily have resulted in very large-scale victimization."
The good news is that the FBI seized and shut down the cloud-based infrastructure used in the FaceStealer social engineering scheme. But federal officials fear that North Korean hackers could continue using the same tactics to target more users.
“North Korea’s FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security-conscious computer user,” said Patrick Grandy, FBI Assistant Director in Charge at the Los Angeles Field Office. “It exploits our trust in ubiquitous video conference platforms and valued personal relationships. If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough."