US says North Korean hackers used fake calls
AM730 · 2 SOURCESabout 10 hours ago2 MIN
Summary
The FBI and the US Department of Justice said they disrupted cloud infrastructure tied to a North Korean hacking campaign known as “FaceStealer,” which allegedly stole more than US$400 million in cryptocurrency over the past 18 months. According to the authorities, the operation relied on fake or stolen social media accounts, sham video meetings and malware-laced links to compromise victims’ devices. The campaign mainly targeted people working in cryptocurrency and Web3, with particular focus on open-source software developers and maintainers. The FBI said more than 900 victims were caught in the scam, while North Korea was accused of using crypto theft proceeds to fund illegal weapons programmes, an allegation Pyongyang denies.
Key Points
- The FBI said North Korean state-controlled hackers used a social-engineering scam called “FaceStealer” to steal over US$400 million in crypto within 18 months.
- US authorities said the hackers used fake or stolen social media profiles to invite targets into bogus video calls on imitation meeting platforms.
- During the calls, attackers allegedly played pre-recorded or deepfake videos of familiar contacts or well-known crypto figures, then faked audio problems.
- Victims were prompted to click a pop-up or link to “fix” the sound, but the action instead downloaded malware onto their devices.
- The Justice Department linked the operation to North Korea-backed groups including Sapphire Sleet, UNC1069, APT38 and BlueNoroff.
Why It Matters
For Hong Kong readers working in digital assets, software development or cross-border tech hiring, the case shows that ordinary video meetings can become a delivery channel for malware, even when the caller appears familiar. It also underlines the risk to firms that rely on open-source contributors and remote collaboration, because a single compromised device can expose wallets, contacts and internal applications.