North Korean Hackers Steal Over $400 Million Through Fake Video Call Scam Campaign

Overview of the Scam

According to an alert issued by the Federal Bureau of Investigation (FBI) on January 12, 2024, a group linked to North Korea's cybercrime division has conducted a large-scale social engineering campaign called "FaceStealer." This operation exploits artificial intelligence (AI) and unauthorized recordings to deceive professionals in the cryptocurrency, Web3, and technology sectors. Over the past 18 months, more than $400 million in cryptocurrency has been stolen.

How the Scam Works

Stage 1: Account Compromise

Cybercriminals first attempt to compromise messaging apps and social media accounts belonging to previous victims. Once these legitimate accounts are taken over, the criminals can contact new targets using trusted identities.

Stage 2: Fake Video Calls

Using the hijacked accounts, perpetrators send links to fake platforms that appear to be legitimate tools like Zoom or Microsoft Teams. When victims join the call, they are confronted with AI-generated or pre-recorded footage of other people, creating the false impression that legitimate participants are present.

Stage 3: Malware Installation

During the call, the scammer claims technical problems with audio or connectivity and provides malicious links or instructions to execute commands in the computer's terminal. Victims, pressured by the sense of urgency, unknowingly install malware that steals access credentials, private keys, and digital assets stored on their machines.

Targeting Software Developers

Beyond direct cryptocurrency theft, this group also targets software developers and code repository maintainers. The goal is to insert malicious code into software supply chains to affect vast numbers of users globally.

Through fake job interviews and technical assignments, engineers are induced to clone compromised code repositories. These can then be distributed through open-source platforms to launch large-scale attacks.

Warning Signs

• Unexpected Contact: Sudden video call requests from people claiming to know you
• Unnatural Presentation: Look for visual glitches, distortions, or unnatural backgrounds in video feeds
• Technical Problem Claims: Scammers interrupt calls with fake audio or connection issues
• Command Requests: Being prompted to execute unfamiliar commands in a computer terminal
• Weak Context: Conversations feel unnatural with poor business context

Prevention Tips

For All Users

• Never click links from untrusted sources
• Verify identities through separate communication channels even in video calls
• Never execute unfamiliar commands in terminal or command-line interfaces
• Enable two-factor authentication on all accounts
• Keep all software updated to the latest versions

For Developers and Security Professionals

• Never run unfamiliar code repositories directly on personal machines
• Always validate code in isolated virtual machine environments
• Strengthen security reviews across entire software supply chains
• Verify legitimate processes when receiving technical tasks during job interviews

Where to Report

If you suspect a breach or fraud, take immediate action:

• Report to relevant law enforcement agencies (FBI, local police)
• Notify your organization's security team immediately
• Alert your cryptocurrency exchange to freeze accounts if applicable
• Terminate all active sessions
• Change all access credentials immediately
• Transfer cryptocurrency assets to cold wallets (offline storage) as soon as possible