North Korean hackers steal more than $400 million using video images, FBI says

The FBI says North Korean hackers stole more than $400 million in cryptocurrency over the past 18 months using a scheme called FaceStealer, Reuters reported. The Justice Department announced it had seized cloud infrastructure supporting that separate hacking operation, Bloomberg.com reported. FaceStealer works by hijacking victims’ messaging and social-media accounts and using them to invite the victim’s contacts to fake Zoom or Microsoft Teams meetings, according to Bloomberg.com. Once a target joins, the hackers play prerecorded webcam footage of someone the target knows, manufacture an apparent technical problem, and offer a “fix” that instead installs malware, Bloomberg.com reported. The FBI seized more than 900 webcam videos secretly recorded from victims and later used to impersonate them, Bloomberg.com reported. The hackers have also begun using deepfakes of prominent figures in the cryptocurrency industry to make fraudulent meetings more convincing, Bloomberg.com reported. Patrick Grandy, assistant director in charge of the FBI’s Los Angeles field office, said in a statement quoted by Bloomberg.com: “If you can’t imagine a scenario where you might fall prey to it, you are not thinking creatively enough.” The FaceStealer disclosure comes alongside a separate, much larger case. The Justice Department said it joined with the two biggest stablecoin issuers to secure almost half of the more than $6 billion stolen from Binance in the Oct. 29 break-in, Bloomberg.com reported. The department received court authorization to seize or restrain $1.2 billion of the $2.7 billion frozen by Tether and Circle Internet Group Inc., Bloomberg.com reported. Binance said it replaced all $6.3 billion in stolen assets using profits and emergency funds, Gizmodo reported. The FBI, Secret Service and Internal Revenue Service issued an alert attributing the Binance theft to North Korea and urging digital-asset companies to block transactions involving hacker addresses, Bloomberg.com reported. North Korea has denied responsibility for cryptocurrency thefts attributed to it, Bloomberg.com reported.