North Korea’s FaceStealer Turns Your Friends’ Faces Into Bait
The FBI says North Korea's FaceStealer scheme stole more than $400 million in crypto using hijacked contacts, recorded webcam video and deepfakes on fake Zoom and Teams calls; its infrastructure has been seized.
North Korean hackers have taken more than $400 million in cryptocurrency over the last 18 months by inviting people to video calls with friends who weren’t really there. The Hacker News reports that the FBI has seized the cloud infrastructure behind the scheme, which it calls FaceStealer, along with more than 900 webcam recordings of past victims used to fool the next ones. In the same set of actions, the Justice Department announced the seizure and restraint of over $1.2 billion in crypto stolen from Binance by North Korea’s TraderTraitor actors.
For defenders
Who: the activity is tied to BlueNoroff, the money-stealing North Korean cluster also tracked as APT38, Sapphire Sleet and UNC1069 (our profile: https://threatroundup.com/threat-actors/apt38/). Targets are people in crypto, Web3 and finance, plus open-source maintainers; the same playbook was used against the Axios npm maintainer earlier this year, per the report. Arctic Wolf now counts 677 targets in 58 countries, more than 80% of them founders and executives.
How it works (per the FBI advisory): a hijacked Telegram, LinkedIn, Slack or Discord account messages the victim’s contacts about an “investment opportunity”, books a call through Calendly, then sends a typosquatted Zoom or Teams link: T1586.001 (Compromise Accounts: Social Media Accounts), T1566.003 (Phishing: Spearphishing via Service). On the call, the “participants” are recordings of the trusted contact and deepfakes of well-known industry figures, while the target’s own webcam is recorded for the next round. Seconds in, a fake audio error points to a “fix”: an update link, a script, or a command to paste into a terminal: T1204.004 (User Execution: Malicious Copy and Paste). The malware then takes wallets, seed phrases and the victim’s messaging accounts, and the cycle repeats.
What’s new: Arctic Wolf says the crew now scrapes YouTube interviews and conference talks to fake a specific founder’s face and voice without hacking them first, and adds lures such as a fake Chrome PDF Viewer update. No CVE is involved and the malware isn’t named in the report.
uu01webzoom[.]us (fake Zoom meeting link)
teams.livemeet[.]us (fake Teams meeting link)What it means for you
The trick works because the invite really does come from someone you know: their account has been taken over. The face on the call may be a recording or a deepfake. If you work anywhere near crypto or investing, treat a surprise “let’s jump on a call” from a contact with the same suspicion as a stranger’s email, and remember that no real meeting app needs you to paste a command or install a special “audio fix” mid-call.
Do this now
- Confirm any unexpected meeting invite through a different channel, such as a phone call to a number you already have.
- Only join Zoom or Teams from the official app or a link you can see ends in zoom.us or teams.microsoft.com.
- If a call suddenly asks you to update, run a script or paste a command, hang up. That is the attack.
- Keep large crypto holdings in a hardware wallet, and never type a recovery phrase into a computer.