The FBI has disrupted cloud-based infrastructure used in FaceStealer, a scheme attributed to North Korean hackers, the Justice Department announced on November 12. The operation seized over 900 victim webcam videos and targeted infrastructure supporting cryptocurrency theft exceeding $400 million over an 18-month period.
How the Scheme Operates
FaceStealer exploits compromised accounts on services including Telegram, LinkedIn, Slack, and Discord. Attackers gain access to chat histories, allowing them to craft personalized meeting invitations that reference prior conversations and build trust with targets.
The scheme directs targets to counterfeit video conferencing sessions mimicking Zoom or Microsoft Teams interfaces. Once a target joins, pre-recorded webcam footage of a known contact appears on screen, creating the illusion of a legitimate meeting with a familiar person.
During the call, an attacker claims a technical problem exists and offers a solution. The proposed fix may include an update prompt or code to paste into a terminal. Following these instructions installs malware capable of harvesting browser cookies, logging keystrokes, capturing screens, and maintaining persistent device access.
The Attack Cycle
The compromised device becomes a source for the next phase of the attack. Stolen communication accounts, contact lists, and newly recorded webcam footage provide material for subsequent approaches targeting the victim's contacts. The FBI reported cases where cryptocurrency theft occurred months or longer after initial device compromise, indicating attackers may wait before exploiting access.
Protective Measures
The FBI recommends several steps to reduce risk:
- Confirm meeting invitations through a separate communication channel before joining
- Use official meeting applications with invite codes
- Delay enabling webcams until verbal communication confirms the other participant's identity
- Refuse to run scripts or paste terminal code presented as video-client updates
For those who suspect compromise, the FBI advises creating new cryptocurrency wallets on unaffected devices, securing communication and developer accounts, alerting contacts and employers, and reporting to IC3 with the keyword FaceStealer.
