LOS ANGELES, CA — Is that your boss on Zoom or a North Korean hacker using a deepfake to rob you before moving on to your friends and colleagues? It could be either, the FBI in California warned Thursday.
A video call invitation from a friend or colleague could be a trap, even if you recognize the person on the screen, federal authorities are warning.
The FBI is sounding the alarm about a sophisticated North Korean hacking scheme known as "FaceStealer" that uses fake video meetings, secretly recorded webcam footage and artificial intelligence-generated deepfakes to trick more than 900 people into installing malicious software on their computers.
The scheme has resulted in the theft of more than $400 million in cryptocurrency over the past 18 months, according to the U.S. Department of Justice.
Federal authorities announced Thursday that they had seized cloud-based infrastructure used by the hackers. The FBI also recovered more than 900 webcam videos secretly recorded from victims and used to deceive others.
The attacks have primarily targeted people working in cryptocurrency and technology, but the FBI is warning of a potentially much broader threat as hackers increasingly target developers responsible for software used by millions of people.
The FBI's Los Angeles Field Office helped lead the investigation.
"North Korea's FaceStealer is a highly effective social engineering scheme capable of deceiving even the most experienced technical and security conscious computer user," said Patrick Grandy, assistant director in charge of the FBI's Los Angeles Field Office.
"It exploits our trust in ubiquitous video conference platforms and valued personal relationships."
The attack typically begins with a message from someone the victim knows.
Hackers take over legitimate accounts on platforms such as Telegram, LinkedIn, Slack and Discord, then contact people on the account holder's friends or professional contact lists.
The message may suggest catching up, discussing a business opportunity or scheduling a meeting. Because it comes from an actual account belonging to someone the recipient knows, it may not immediately raise suspicion.
The hackers then send a meeting invitation that appears to link to Zoom or Microsoft Teams. Instead, it directs the victim to a convincing imitation of the video conferencing platform.
Once the meeting begins, the victim may see a familiar face on screen.
But that person isn't actually there.
The hackers are playing webcam footage secretly recorded from previous victims, making it appear that trusted contacts are participating in the meeting. In some cases, they also use AI-generated deepfakes of prominent people in the cryptocurrency industry.
The scam takes a dangerous turn when the victim is told there's a technical problem, such as a malfunctioning microphone.
The supposed solution may involve clicking an update button, downloading software or copying and pasting code into the computer's terminal.
Following those instructions can install malware capable of stealing passwords, accessing cryptocurrency wallets, recording activity and giving hackers control of the computer.
The hackers may then steal the victim's contacts and webcam footage to repeat the scam with another group of people.
In some cases, the hackers waited months or more than a year after compromising a computer before stealing cryptocurrency, according to the FBI.
Although FaceStealer has primarily targeted cryptocurrency investors and people working in the Web3 industry, federal investigators say the hackers have expanded their efforts to developers who maintain widely used software.
That could have consequences well beyond cryptocurrency.
The FBI described an incident earlier this year in which hackers tricked the maintainer of a popular open-source JavaScript library into joining a fake Teams meeting.
After convincing the developer to install malware, the hackers used the compromised account to create malicious software that could have been distributed alongside legitimate downloads of the library, which receives tens of millions of downloads per week.
The attack was detected and disrupted before it could cause widespread damage, according to the FBI.
Investigators warned that a successful attack against a widely used software library could potentially expose millions of people to malicious code, including those who never participate in cryptocurrency transactions.
The FBI released several recommendations for avoiding the scam, particularly for people who regularly participate in online meetings or handle cryptocurrency.
The agency recommends:
The FBI also warned that hackers sometimes send malicious meeting links shortly before scheduled calls, even when the original calendar invitation appeared legitimate.
People who believe they may have installed malware through a suspicious meeting should act quickly to protect their accounts and warn their contacts, according to the FBI.
The agency recommends changing passwords, signing out of active sessions and enabling multifactor authentication on sensitive accounts.
Anyone with cryptocurrency potentially exposed to the hackers should create a new wallet with new recovery phrases using a device that was not involved in the suspicious meeting, then transfer their assets to it.
Victims should also alert friends and colleagues that their messaging accounts or recorded webcam footage could be used to impersonate them.
If the compromised computer contains work files or provides access to an employer's systems, the FBI recommends notifying the employer about the potential breach.
Suspected FaceStealer attacks can be reported to the FBI's Internet Crime Complaint Center. The agency asks victims to include the keyword "FaceStealer" in their reports.
Additional information about the scheme is available at the FBI's website.
Sign up for free local newsletters and alerts for the
Los Angeles Patch
Patch.com is the nationwide leader in hyperlocal news.
Visit Patch.com to find your town today.