US freezes $2.7 billion from North Korean Binance heist and

North Korean hackers have utilized a sophisticated campaign known as FaceStealer to defraud victims of more than $400 million in cryptocurrency over an 18-month period. By leveraging AI-generated deepfakes and stolen webcam footage, the attackers successfully impersonated trusted contacts and industry figures to facilitate malware distribution.

What happened

The FaceStealer operation relied on a multi-stage social engineering process designed to exploit the trust inherent in professional video meetings. Attackers typically began by compromising a victim's communications accounts, which they then used to send video call invitations to the victim's professional contacts. Once a target joined the call, the hackers employed one of two primary deception methods: playing prerecorded webcam footage of a known individual or utilizing AI-generated deepfake videos to impersonate influential figures within the cryptocurrency and Web3 industries.

These visual deceptions were maintained only long enough to introduce a fabricated technical issue, such as a malfunctioning microphone. Under the guise of troubleshooting this technical problem, the attackers instructed victims to follow a link or perform specific actions that resulted in the installation of malware. This malware granted the hackers persistent access to the victim's computer, enabling them to steal cryptocurrency, hijack additional communications accounts, or compromise other connected systems. The FBI's investigation into the campaign led to the seizure of cloud infrastructure supporting the operation and the recovery of more than 900 webcam recordings of victims used in the scheme.