FBI says North Korean hackers stole $400m by hijacking video calls
The Facestealer campaign targeted more than 900 crypto and Web3 workers over 18 months by secretly recording webcams during fake recruitment interviews.
Key takeaways
- 1The Facestealer campaign stole over $400m from more than 900 victims.
- 2Attackers hijacked Telegram and LinkedIn accounts to target Web3 workers.
- 3Hackers used fake Zoom and Teams calls to secretly record user webcams.
The FBI said North Korean hackers stole more than $400m from at least 900 victims over the last 18 months through a campaign targeting crypto industry workers. The attackers hijacked legitimate Telegram and LinkedIn accounts to lure staff into fake recruitment or technical calls on platforms disguised as Zoom and Microsoft Teams. Once the targets joined the calls, the hackers secretly recorded their webcams and used the footage to facilitate the theft.
The campaign, which investigators named Facestealer, focuses on workers in the Web3 and digital asset sectors. By taking over existing social media profiles, the hackers established trust with their targets before moving the conversation to video conferencing software. The FBI said the group used these fake calls to gain access to sensitive information or to record biometric data that could be used to bypass security measures.
This tactic follows reports of North Korean groups using increasingly sophisticated social engineering to infiltrate crypto firms. Coinbase chief executive Brian Armstrong said on 8 November that applicants for remote roles at his exchange had received off-camera coaching during live video interviews. Other investigations have found that North Korean hackers are also using meme tokens on the NEAR protocol to launder stolen funds and targeting human vulnerabilities rather than software bugs.
The scale of the Facestealer campaign suggests that North Korean state-sponsored groups are moving away from purely technical exploits toward psychological manipulation of staff. Security teams are now watching for signs of account hijacking on professional networks and advising employees to verify the identity of recruiters through multiple channels. The FBI warned that these tactics allow attackers to bypass traditional hardware security keys by using the victim's own recorded likeness.
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.