North Korean hackers steal more than $400 million using video images, FBI says

As part of a social engineering scheme, which the FBI refers to as “FaceStealer,” targets are lured to video chats on imposter versions of video meeting software such as Zoom, Microsoft Teams and Google Meet.

The targets are issued invitations from genuine contacts they have previously interacted with, but whose social media and communication accounts have been compromised and whose images have been secretly recorded.

Once on the call, the targets — who are also being recorded — encounter a mock technical error which requires a fix by clicking a link, which then infects the target’s computer and social media accounts. The target’s contacts are then used to target additional people. 

The FBI has identified and seized more than 900 victim webcam videos, according to Wednesday’s advisory.

Hackers are starting to use artificial intelligence to create deepfake videos of well-known and influential people in the cryptocurrency and blockchain industries, the FBI said.

The FBI attributed the activity to a cluster of North Korean hackers known as “Sapphire Sleet” or UNC1069, a separate group from the North Korean hackers linked by the FBI and private industry to the recent $6.3 billion hack of cryptocurrency exchange Binance.

(Reporting by AJ Vicens in Detroit; Editing by Nia Williams)