North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and Teams calls filled with webcam footage of earlier victims. The FBI calls the scheme FaceStealer. It has seized more than 900 of those recordings, and on November 12 it warned crypto and web3 workers and open-source maintainers about the scheme.
Source: FBI
Every successful call infects the target and records them, so each new victim becomes the familiar face on the next call. The FBI ties the activity to the group tracked as Sapphire Sleet, BlueNoroff and APT38, among other names. The hackers go after computers that hold a crypto wallet, a seed phrase, or access to an employer’s network or a code repository.
The audio problem is the attack
The invite comes from a real account. The hackers take over earlier victims’ Telegram, LinkedIn, Slack and Discord accounts, read their chat histories, and message the victims’ contacts about catching up or an investment. A Calendly invite sets the time. The meeting link arrives shortly before the call and points to a lookalike domain such as uu01webzoom[.]us.
Once you’re in the call, the hackers play your contact’s recorded video, often next to clips of other “participants.” A chat message then says the others can’t hear you and walks you through an update, a script, or a command to paste into your terminal. Following those steps installs a cookie harvester, keyloggers, a screen capturer and a backdoor. Your webcam has been recording since you clicked the link.
The hackers are in no hurry. In several cases they waited from a few months to more than a year for wallet balances to grow before emptying them.
A JavaScript library came close
Earlier this year the group got the maintainer of a major open-source JavaScript library into a fake Teams call that included at least one person he recognized. He ran the fix. The hackers then used his access to create malicious dependencies that would download along with the library, which gets tens of millions of downloads a week. The attack was caught and stopped quickly. The FBI has seen other attempts against maintainers on npm and, more recently, maintainers of Rust crates.
The group has also started building deepfakes of well-known crypto figures from public photos and video. “The quality of the deepfakes only needs to be good enough to pass as webcam video,” the FBI wrote. Stolen footage of real victims still makes up the overwhelming share of the scheme.
Keep the camera off
The FBI’s advice starts with the webcam: leave it off until you can see, hear and talk with the person who invited you. Join through the official Zoom or Teams app with an invite code. Confirm the meeting through a second channel, for example a phone call when the invite came over Telegram. Don’t run scripts or paste code to fix a meeting app.
Keep only small amounts in browser extension wallets, and store no recovery phrases or private keys on your devices. A thief with a copied seed phrase can drain the wallet whenever they choose. If you suspect a compromise, create a new wallet on a clean device and move everything into it.
