$400 million theft using video images by North Korean hackers

State-sponsored hackers from North Korea have stolen more than $400 million in cryptocurrency over the last 18 months by using secretly recorded videos and images of individuals, the FBI said on Thursday. This sophisticated social engineering scheme has been named "facestealer" by the FBI.

In this fraud, targets are lured into video chats through fake versions of video meeting software such as Zoom, Microsoft Teams, and Google Meet. The hackers operate with extreme cunning during this process. Targets receive invitations from their actual contacts who have previously interacted with them. However, in reality, the social media and messaging accounts of these contacts have been hacked by the hackers, and their images have been secretly recorded.

When the targeted individual joins a video call, they encounter a fake technical glitch. They are asked to click on a link to fix this glitch, and upon clicking, the target's computer and social media accounts become infected. Subsequently, that person's contacts are used to target others. According to an advisory released by the FBI on Wednesday, the agency has identified and seized webcam videos of more than 900 victims so far.

The FBI further warned that hackers are now beginning to use artificial intelligence to create deepfake videos of well-known and influential people in the cryptocurrency and blockchain industry. The FBI has held a North Korean hacker group known as "Sapphire Sleet" or UNC1069 responsible for this activity. The FBI clarified that this group is distinct from the North Korean hackers linked to the recent $6.3 billion hacking incident involving cryptocurrency exchange Binance.

Sapphire Sleet was a hacker group linked to North Korea known for cyberattacks. This group has been responsible for various types of cyberattacks and data theft.