Follow us on Google News
WASHINGTON: Cybercriminals linked to North Korea have stolen more than Rs 3,500 crore worth of cryptocurrency over the past 18 months, according to the U.S. Federal Bureau of Investigation (FBI). Revealing the cyber campaign on Friday, the agency warned that hackers are actively targeting individuals connected to cryptocurrency, Web3, and open-source software development. To carry out these attacks, the criminals are relying on social engineering, fake video calls, and deepfake technology powered by artificial intelligence (AI).
According to the investigative agency, cybercriminals have shifted their tactics to gain the trust of targets and access their devices. Rather than relying solely on fake emails or suspicious links, they are now using the identities of acquaintances, colleagues, and professional contacts to lure victims into their trap. As part of this process, accounts on social media and communication platforms are being compromised.
Plot to Win Trust Through Fake Video Calls
In this cyber campaign, hackers breach accounts on social media and other communication platforms and send video call invitations to the contacts of those accounts. During the call, they may use pre-recorded videos or AI deepfakes. This leads the person on the other end to believe they are speaking with an acquaintance or a trusted professional.
Once the video call begins, the cybercriminals stage a technical glitch. They claim there is an issue with the audio, video, or connection during the call. Under the pretext of fixing the problem, they send a link to the other person and ask them to click on it.
Hackers present this entire process as routine technical support so the victim does not suspect anything. As soon as the individual clicks the provided link or follows the instructions and files shared through it, their device can be compromised by a cyberattack. The criminals then attempt to gain access to sensitive information and digital assets.
Use of Facestealer and Social Engineering
The role of techniques such as Facestealer and social engineering has also emerged in these attacks. The term Facestealer refers to cyber methods in which an individual’s identity, online profile, or digital presence is misused to deceive others.
Instead of exploiting technical flaws, social engineering targets human behavior and trust. Criminals convince the victim that the person contacting them is genuine and trustworthy. During the conversation, they create a situation where the victim willingly opens a suspicious link or shares sensitive details.
The risk is particularly severe for people associated with the cryptocurrency and Web3 sectors, as their digital wallets, private cryptographic keys, and other financial details can provide direct access to digital assets. Once criminals gain control over this information, the cryptocurrency can be transferred to another wallet.
Open-Source Developers Also Targeted
The hackers are not only targeting crypto investors and traders. Specialists developing open-source software and professionals working in Web3 technology are also being singled out. These individuals often have access to critical software projects, digital platforms, and technical systems. Compromising their accounts or devices can create broader security risks in addition to personal financial losses.
The use of AI deepfakes has further complicated this threat. Previously, replicating a person’s voice or video was relatively difficult, but readily available AI tools have made it easier to generate fake audio and video. This can make distinguishing between real and fake video calls challenging.
The FBI’s warning comes at a time when the activities of North Korea-linked hacker groups in cryptocurrency-related cybercrimes remain a concern for international security agencies. The agency’s primary message is that a video call should not be trusted solely on the basis of a familiar face or voice. Any link sent to resolve a technical issue must be independently verified, and extra caution is needed to protect digital wallets, private keys, and sensitive accounts.
