FBI Disrupts FaceStealer Campaign Tied to $400 Million Theft

The FBI and Justice Department disrupted cloud infrastructure used in FaceStealer, a North Korea-linked campaign the bureau says stole more than $400 million in cryptocurrency over the past 18 months. Investigators also seized more than 900 webcam videos associated with the operation, which used recordings of victims to impersonate trusted contacts in fake online meetings.

The attackers took over messaging or social media accounts and used them to invite contacts to video calls that appeared to involve people they knew. In the calls, hackers played secretly recorded footage of earlier victims, sometimes alongside fabricated participants. They then described a supposed technical problem and instructed targets to run a script, click a link or paste commands into a computer terminal. Those steps installed malware, according to the FBI.

The malware could collect browser cookies, record keystrokes, capture screens and provide continued access to a device, the bureau said. In some cases, investigators said, attackers waited months or more than a year after compromising a computer before taking cryptocurrency, monitoring victims’ wallet balances in the meantime.