The 6 Stages of FaceStealer: Are You a Victim of North Korean Scam?

U.S.NewsPoliticsAI PoliticsTechFact CheckSportsGlobalIran WarRussia-UkraineMiddle EastChina And AsiaLive BlogBetter PlanetAll World NewsLifestyleFamily & ParentingEntertainmentTravelPetsAutomotiveRelationshipsScienceHealthPersonal FinanceBetter WorkplacesReaders ChoiceOpinionMy TurnAll OpinionRankingsHealthCorporate ResponsibilityFinanceProductsEducationWorkAll RankingsWatchThe 1600The Royal ReportUnconventionalFrom The PaddockNewsmakersSocialFacebookInstagramYouTubeRedditTikTokTwitter/XExtraNewslettersDare to DreamEventsEssaysPodcastsVantageInsightsMagazineCEO CircleAnnouncementsLeadershipDev Pragad North Korean hackers have stolen more than $400 million in cryptocurrency by posing as friends and colleagues during fake video calls, the FBI has revealed. The scam involves hijacking messaging accounts, secretly recording people through their webcams and using the footage to trick their contacts into installing malicious software. The hackers created convincing copies of Zoom, Microsoft Teams and Google Meet, using familiar faces and fake technical glitches to gain access to victims' computers. The FBI said on Thursday that the operation, known as "FaceStealer," had stolen more than $400 million over the past 18 months. Agents have seized computer infrastructure used in the scheme, along with more than 900 webcam recordings of victims. How Does FaceStealer Work? The FBI has outlined six stages of the scam, with each victim potentially leading the hackers to more targets. Stage 1: Compromising the First Victim The hackers start with someone whose computer has already been compromised. They search for cryptocurrency wallets and passwords, access the person's contacts and messages, and secretly record their webcam while they wait to join a video call. Stage 2: Hijacking Messaging Accounts The hackers take over accounts on platforms including Telegram, LinkedIn, Slack and Discord. Posing as the account holder, they contact friends and colleagues to arrange video calls, often suggesting they catch up, discuss a project or talk about investment opportunities. They can also use previous messages to make the invitation more convincing. Stage 3: Setting Up Fake Video Calls The hackers sometimes use legitimate scheduling services such as Calendly to arrange meetings. Shortly before the call, the target receives what appears to be a Zoom or Teams link. But the link takes them to a fake video conferencing website controlled by the hackers. Stage 4: Playing Secretly Recorded Footage When the target joins, they see what appears to be their friend or colleague on camera. In reality, the hackers are playing a recording secretly captured during an earlier attack. They sometimes play several recordings to make it look as though multiple people are attending the meeting. Stage 5: Tricking Victims Into Installing Malware The hackers then create a fake technical problem, often claiming the target's microphone is not working. Posing as the trusted contact, they instruct the person to download an update, click a link or run code on their computer. Following those instructions installs malware that can steal information, record keystrokes and capture screenshots. The hackers also record the new victim's webcam. Stage 6: Repeating the Attack With access to another computer, the hackers can steal cryptocurrency, hijack messaging accounts and contact the victim's friends and colleagues. They then repeat the process using the new victim's identity. The FBI said some victims were not robbed immediately. In several cases, hackers waited months or more than a year before stealing cryptocurrency, sometimes allowing wallet balances to increase. Hackers Also Used Deepfake Videos The FBI said the hackers have also begun using AI-generated videos to impersonate prominent figures in the cryptocurrency industry. They use publicly available photos and recordings to create fake appearances by people their targets might recognize. However, investigators said the scheme still relies overwhelmingly on genuine webcam footage stolen from previous victims. The FBI said it had identified and seized more than 900 webcam recordings used in the scheme. Patrick Grandy, assistant director in charge of the FBI's Los Angeles field office, said: "It exploits our trust in ubiquitous video conference platforms and valued personal relationships." Millions More Could Have Been Exposed The hackers also targeted developers responsible for widely used software. Earlier this year, they compromised a developer who maintained a popular JavaScript software library downloaded tens of millions of times each week. The developer was tricked into joining a fake Teams meeting and following instructions to fix a supposed technical problem. The hackers then used the developer's access to create malicious software components that could have been distributed alongside legitimate downloads. The FBI said the attack was detected before it could cause widespread harm. What Has the FBI Done? The Justice Department announced on Thursday that authorities had seized cloud-based infrastructure used in the FaceStealer operation. The FBI attributed the scheme to North Korean state-sponsored hackers known by several names, including Sapphire Sleet, BlueNoroff and Stardust Chollima. U.S. officials say North Korea uses cryptocurrency theft to help fund its weapons program. How Do You Know If You've Been Targeted? The FBI warned that unexpected video invitations, even from people you know, could be part of the scam. A particular warning sign is being told to install software, click an update link or run commands to fix a microphone or other technical problem during a call. The agency recommends joining meetings through official applications using meeting codes, rather than clicking unfamiliar links, and confirming invitations through another method of communication. It also advises keeping webcams switched off until you can see, hear and communicate with the person who invited you. Anyone who suspects their computer has been compromised should secure their accounts, change passwords and warn their contacts. Cryptocurrency holders should move their assets to a new wallet created on a device that was not exposed to the hackers. Victims can report suspected FaceStealer activity to the FBI at IC3.gov, using the keyword "FaceStealer." Contact Newsweek editors on this story: Rebecca Flood and Emma Lee-Sang10Loading video…By Chris Matthews0ShareNewsweek is a Trust Project memberSee more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.North Korean hackers have stolen more than $400 million in cryptocurrency by posing as friends and colleagues during fake video calls, the FBI has revealed.

The scam involves hijacking messaging accounts, secretly recording people through their webcams and using the footage to trick their contacts into installing malicious software.

The hackers created convincing copies of Zoom, Microsoft Teams and Google Meet, using familiar faces and fake technical glitches to gain access to victims’ computers.

The FBI said on Thursday that the operation, known as “FaceStealer,” had stolen more than $400 million over the past 18 months.

Agents have seized computer infrastructure used in the scheme, along with more than 900 webcam recordings of victims.

The FBI has outlined six stages of the scam, with each victim potentially leading the hackers to more targets.

The hackers start with someone whose computer has already been compromised.

They search for cryptocurrency wallets and passwords, access the person’s contacts and messages, and secretly record their webcam while they wait to join a video call.

The hackers take over accounts on platforms including Telegram, LinkedIn, Slack and Discord.

Posing as the account holder, they contact friends and colleagues to arrange video calls, often suggesting they catch up, discuss a project or talk about investment opportunities.

They can also use previous messages to make the invitation more convincing.

The hackers sometimes use legitimate scheduling services such as Calendly to arrange meetings.

Shortly before the call, the target receives what appears to be a Zoom or Teams link.

But the link takes them to a fake video conferencing website controlled by the hackers.

When the target joins, they see what appears to be their friend or colleague on camera.

In reality, the hackers are playing a recording secretly captured during an earlier attack.

They sometimes play several recordings to make it look as though multiple people are attending the meeting.

The hackers then create a fake technical problem, often claiming the target’s microphone is not working.

Posing as the trusted contact, they instruct the person to download an update, click a link or run code on their computer.

Following those instructions installs malware that can steal information, record keystrokes and capture screenshots.

The hackers also record the new victim’s webcam.

With access to another computer, the hackers can steal cryptocurrency, hijack messaging accounts and contact the victim’s friends and colleagues.

They then repeat the process using the new victim’s identity.

The FBI said some victims were not robbed immediately. In several cases, hackers waited months or more than a year before stealing cryptocurrency, sometimes allowing wallet balances to increase.

The FBI said the hackers have also begun using AI-generated videos to impersonate prominent figures in the cryptocurrency industry.

They use publicly available photos and recordings to create fake appearances by people their targets might recognize.

However, investigators said the scheme still relies overwhelmingly on genuine webcam footage stolen from previous victims.

The FBI said it had identified and seized more than 900 webcam recordings used in the scheme.

Patrick Grandy, assistant director in charge of the FBI’s Los Angeles field office, said: “It exploits our trust in ubiquitous video conference platforms and valued personal relationships.”

The hackers also targeted developers responsible for widely used software.

Earlier this year, they compromised a developer who maintained a popular JavaScript software library downloaded tens of millions of times each week.

The developer was tricked into joining a fake Teams meeting and following instructions to fix a supposed technical problem. The hackers then used the developer’s access to create malicious software components that could have been distributed alongside legitimate downloads.

The FBI said the attack was detected before it could cause widespread harm.

The Justice Department announced on Thursday that authorities had seized cloud-based infrastructure used in the FaceStealer operation.

The FBI attributed the scheme to North Korean state-sponsored hackers known by several names, including Sapphire Sleet, BlueNoroff and Stardust Chollima.

U.S. officials say North Korea uses cryptocurrency theft to help fund its weapons program.

The FBI warned that unexpected video invitations, even from people you know, could be part of the scam.

A particular warning sign is being told to install software, click an update link or run commands to fix a microphone or other technical problem during a call.

The agency recommends joining meetings through official applications using meeting codes, rather than clicking unfamiliar links, and confirming invitations through another method of communication.

It also advises keeping webcams switched off until you can see, hear and communicate with the person who invited you.

Anyone who suspects their computer has been compromised should secure their accounts, change passwords and warn their contacts.

Cryptocurrency holders should move their assets to a new wallet created on a device that was not exposed to the hackers.

Victims can report suspected FaceStealer activity to the FBI at IC3.gov, using the keyword “FaceStealer.”

Contact Newsweek editors on this story: Rebecca Flood and Emma Lee-Sang