.jpg)
What happened
The FBI announced it disrupted a North Korean cyber operation called FaceStealer that stole more than $400 million in cryptocurrency over an 18-month period. According to an FBI report and Flash alert, North Korean hackers secretly recorded more than 900 tech workers’ webcams during video calls and used the footage to impersonate trusted colleagues.
The hackers sent messages pretending to be someone the victim knew or an important industry figure, then lured targets into fake Zoom or Microsoft Teams meetings. While victims waited for the meeting to start, hackers recorded them without their knowledge. Other participants in the call were recordings of previous victims.
Hackers then told victims their audio was not working and instructed them to download a supposed update that was actually malware. Once installed, the malware gave the attackers access to the victim’s computer.
The Justice Department said it took control of the hackers’ online infrastructure and seized stolen webcam videos. Authorities also have court approval to seize or restrain more than $1.2 billion in stolen assets, part of over $2.7 billion frozen by authorities and private companies.
The FBI alert said the scheme has begun using AI deepfake technology. In one incident, hackers tricked a developer who helps maintain a popular piece of free software into downloading malware, which the agency said could easily have led to very large-scale victimization.