FBI says FaceStealer campaign stole over $400 million

The FBI says it disrupted a North Korean-linked hacking campaign that used recorded faces and fake video calls to steal more than $400 million in cryptocurrency over 18 months. The bureau said it seized the operation’s infrastructure and more than 900 webcam videos of victims.

The FBI calls the scheme FaceStealer. Attackers use compromised accounts belonging to trusted contacts to invite targets to meetings on lookalike versions of services such as Zoom and Microsoft Teams. A prerecorded video of the familiar person plays during the call, while the target may also be recorded.

The attackers then present a supposed audio or technical problem and direct the target to a link or instructions to fix it. The FBI said the process installs malware, which can capture keystrokes and screen information, maintain access to a computer and help attackers take over accounts or steal cryptocurrency. Compromised contacts can then be used to approach additional victims.

The FBI and Justice Department said the operation also involved targeting people who maintain widely used open-source software. In one case, a JavaScript-library maintainer joined a fake Teams meeting featuring a person they...