FBI investigators have seized more than 900 webcam videos. The recordings belonged to tech workers targeted in a North Korean social engineering scheme called FaceStealer, which authorities said amassed more than $400 million in 18 months. The operation used fake Zoom and Teams meetings to persuade victims to install cryptocurrency-stealing malware disguised as an audio fix. Targets included cryptocurrency and web3 workers, as well as open-source developers whose access to software repositories could help hackers compromise programs used by others.According to a report by The Register, the US government said this week that a court had authorised the takedown of cloud infrastructure supporting the scheme, as part of a broader effort to disrupt North Korean cryptocurrency theft.How did fake meeting invitations trap tech workersThe attacks began with invitations sent through hijacked accounts belonging to people the targets might recognise.“You’re going to think it’s real because it’s going to be based on either conversations or interests you’ve expressed in the past with this actual person,” said special agent Jeremy Robertson, who oversees counterintelligence and cyber investigations at FBI Los Angeles.“They’re going to then send you a link to catch up, and it’s usually a calendar invite, and it’s going to have some typo-squatted URLs in there,” he told reporters.Those addresses, designed to resemble legitimate links, opened fake meetings. Hackers secretly recorded victims while showing prerecorded footage of the supposed organiser. Some calls used deepfake videos of recognised industry figures.“When you log in, whoever invited you – your friend or business associate – is going to be on the screen, but you’re not going to hear any audio,” Robertson said. “But you’re going to see their face, you’re going to see them looking around, you’re going to see them mouthing some words, and then in the text box you’re going to receive some instructions.”A supposed audio fix installed malwareMessages told victims their audio was not working and directed them to install a software update. The download installed malware that stole cryptocurrency and sent victims’ contact lists to the attackers, helping them identify further targets. The FBI attributed FaceStealer to Sapphire Sleet, a North Korea-linked hacking group associated with Lazarus Group.“The actors behind this activity, commonly referred to as Sapphire Sleet and other associated names, are part of a broader North Korean effort to generate revenue for the regime, to steal virtual assets, and gain access to networks and trusted online ecosystems,” Brett Leatherman, assistant director of the FBI’s Cyber Division, told reporters. “North Korean hackers are increasingly blending cyber intrusion, social engineering, and emerging technologies such as deep fakes to make their impersonation efforts more convincing and scalable.”Court also authorised action over Binance fundsSeparately, authorities obtained court approval to seize or restrict more than $1.2 billion linked to the October 29 Binance theft. The FBI attributed that $6.3 billion heist to TraderTraitor, another North Korean operation linked to Lazarus.Binance said preparations for the “sophisticated, multi-stage campaign” began in June. The attack involved fake job interviews, malware, compromised internal AI tools, control of employee devices and an “advanced transaction-authorisation method.”Investigators and private-sector partners have helped freeze more than $2.7 billion since the theft. The court authorisation covers more than $1.2 billion of those frozen assets.
Click Here For The Original Source.
——————————————————–
