North Korean hackers stole more than $400 million in cryptocurrency through fake video calls and cloned websites

North Korean hackers have stolen more than $400 million in cryptocurrency over the past 18 months after using fake video calls to obtain identity data and access to devices. According to the FBI and the U.S. Department of Justice, more than 900 people fell victim to the scheme known as “FaceStealer.”

The attackers use fake or hijacked social media accounts to contact people working in the cryptocurrency industry and the web3 sector. Victims are invited to calls held on cloned websites that imitate platforms such as Zoom, Microsoft Teams, or Google Meet.

During the conversation, the hackers play video recordings of previous victims to create the impression of a legitimate call. Subsequently, a message displayed on the screen claims there are problems with the audio and asks users to access a link for “repair.” The link installs malware, allowing access to contacts and applications.

The FBI warns that recordings of the calls are used to lure new victims. U.S. authorities say the proceeds from such attacks finance North Korea’s illegal weapons program. Pyongyang has denied the accusations.