North Korean hackers are using stolen webcam recordings to impersonate crypto workers in fake meetings with their contacts, turning one victim's familiar face into bait for the next attack, the FBI warns.
The Justice Department announced disruption of cloud-based infrastructure used in FaceStealer on November 12. It said the scheme had caused more than $400 million in cryptocurrency theft over the preceding 18 months and that the FBI had seized over 900 victim webcam videos under a federal warrant.
The DOJ release treats FaceStealer separately from the Binance theft, which CryptoSlate has covered through the FBI's attribution and the exchange's asset-replenishment delays.
Related Company Binance Global crypto exchange
A familiar account opens the door
In its November 12 FLASH advisory, the FBI describes attackers taking over genuine accounts on services including Telegram, LinkedIn, Slack and Discord. Access to chat histories lets them tailor an invitation to earlier conversations, giving a new approach the context of an existing relationship.
A legitimate calendaring service can handle the scheduling. The malicious meeting link arrives shortly before the call, directing the target to a copycat Zoom or Microsoft Teams session controlled by the attackers.
Once the target enters, stored webcam footage makes it appear that the known contact has joined. Attackers can simulate several participants. The familiar person on screen can therefore be a real prior victim's recording, rather than a live participant.
The FBI says FaceStealer still overwhelmingly relies on stolen genuine videos. Generated deepfakes provide an additional way to impersonate participants.
The target's webcam becomes part of the attack before the supposed troubleshooting begins. The FLASH says recording starts when the target first clicks the imposter meeting link. The attackers can later use that footage to impersonate the target.
During the meeting, an attacker claims there is an audio or other technical problem. The proposed remedy can be an update prompt, a script or code to paste into a terminal. Following the instructions installs malware, which the FBI says can include tools for harvesting browser cookies, logging keystrokes, capturing screens and maintaining access to the device.
That is where the scheme joins theft to impersonation. Access to the computer can expose cryptocurrency or other valuable access. Stolen communication accounts, contact lists and webcam footage give the hackers material for the next approach. The FBI's FaceStealer resource page describes the same cycle of compromise, account hijacking and fake meetings.
The damage is not necessarily immediate. The FBI reported cases in which cryptocurrency theft and communication-account takeovers came months to more than a year after the initial compromise. A quiet period after a suspicious meeting therefore does not establish that a device or account is safe.
How FaceStealer reuses a victim
A condensed view of the attack sequence described in the FBI's November 12 advisory.
FaceStealer's repeat cycleA clockwise loop shows a hijacked account, recorded face, malware-installing fix and newly compromised victim whose accounts and footage feed the next approach.HOW THE CYCLE REPEATS
1. Hijacked accountAn invitation from a real contact
2. Fake video meetingEarlier victim's video playsYour webcam is also recordedDEVICE + IDENTITY ACCESS
3. Fake technical fixAn update or script installs malware
4. New victimAccounts, contacts and video reused
FaceStealer's repeat cycleFour linked stages lead from stolen accounts through fake meetings and malware to the next victim. The return line shows how accounts and footage are reused.HOW THE CYCLE REPEATS
1Hijacked accountAn invitation froma real contact2Fake video meetingEarlier victim's video playsYour webcam is also recordedwhen the imposter link opens3Fake technical fixAn update or scriptinstalls malware4New victimAccounts, contactsand video reused
Opening the imposter meeting link records webcam footage; following the fake fix installs malware.
The cycle shows reuse, not a fixed timetable or every encounter. The FBI says genuine stolen footage predominates, while generated deepfakes are also used.
Sources and evidence
Sources
- FBI FLASH, November 12
- DOJ disruption announcement
- FBI FaceStealer resource
- The FBI's November 12 FLASH says FaceStealer operators use genuine communication accounts hijacked from earlier victims, including accounts on Telegram, LinkedIn, Slack and Discord, to lure targets into fake video meetings. [1]
- The FBI says FaceStealer's fake Zoom or Teams sessions play stored webcam footage of a prior victim, sometimes with other recorded participants, to make the target believe trusted contacts have joined. [1] [2]
- The FBI's FLASH says FaceStealer operators record a new target's webcam when the target first clicks the imposter meeting link, before the target follows the malware-installation instructions. [1]
- According to the FBI, attackers then claim an audio or technical problem and direct the target to run an update, script or terminal command; following the instructions installs malware that can include a cookie harvester, keyloggers, screen capture tools and a backdoor. [1] [2]
- The FBI says access to a FaceStealer victim's compromised computer permits cryptocurrency theft or exploitation of the victim's other access, while stolen webcam footage, communication accounts and contacts allow attackers to impersonate the victim in further approaches. [1] [3] [2]
- The FBI FLASH says FaceStealer still overwhelmingly relies on genuine stolen victim videos, while generated deepfake videos are an emerging additional technique. [1]
Supporting facts
Method
Editorial condensation of the FBI's reported attack cycle. Arrows show reuse of compromised accounts and footage, not a fixed timetable, growth rate or new calculation.
Scope
The cycle shows reuse, not a fixed timetable or every encounter. The FBI says genuine stolen footage predominates, while generated deepfakes are also used.
Infographic by CryptoSlate
Check the invitation before trusting the face
The FBI recommends using the official meeting application with an invite code and, where possible, confirming an invitation through a different communication channel. That checks the approach beyond the account the attacker may already control.
It also advises delaying webcam activation until the inviter can be seen, heard and communicated with. An apparent technical fault should not lead to running scripts or pasting terminal code presented as a video-client update.
For people who suspect compromise, the bureau recommends securing cryptocurrency in a new crypto wallet created on an unaffected device, securing communication and developer accounts, alerting contacts and employers, and reporting to IC3 with the keyword FaceStealer. Alerting contacts can interrupt further approaches that could reuse the stolen account and recording.