FBI: North Korean fake Zoom scheme stole over $400 million
Original title: Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme
FaceStealer uses seized webcam clips of more than 900 victims so each infected call supplies the next familiar face.
The FBI says North Korean operators tracked as Sapphire Sleet, BlueNoroff and APT38 stole more than $400 million in cryptocurrency over 18 months by luring crypto workers, web3 staff and open-source maintainers into fake Zoom and Teams calls. Compromised Telegram, LinkedIn, Slack and Discord accounts send Calendly invites and lookalike meeting links; victims are told to paste a fix that installs stealers and a backdoor while their webcam is recorded. A malicious-dependency attempt against a widely downloaded JavaScript library was stopped, and the group has also tried npm and Rust maintainers and begun building deepfakes.
Unconfirmed: The $400 million figure and group aliases are the FBI’s attribution of the scheme.
- The FBI seized more than 900 recordings and warned targets on November 12.
- Lookalike domains such as uu01webzoom[.]us host the calls.
- Payloads include a cookie harvester, keyloggers, a screen capturer and a backdoor.
- In some cases thieves waited months to more than a year before draining wallets.
- The JavaScript library gets tens of millions of downloads a week.
Impact: Cryptocurrency theft plus stealers and a backdoor on victim machines
- 1.Keep the webcam off until you can see, hear and talk with the inviter.
- 2.Join only through the official Zoom or Teams app and confirm the meeting on a second channel.
- 3.Do not paste scripts or commands offered as a meeting-app fix.
- ATT&CK
- T1566.002 Spearphishing LinkT1586 Compromise AccountsT1204 User ExecutionT1056.001 KeyloggingT1113 Screen Capture
- Products
- ZoomMicrosoft Teams
- Threat actors
- Sapphire SleetBlueNoroffAPT38
- Organizations
- FBI
- Countries
- North Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | uu01webzoom.us | ly before the call and points to a lookalike domain such as uu01webzoom[.]us. Once you’re in the call, the hackers play your contact’s |
From the original article
2 min read at helpnetsecurity.com
North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and Teams calls filled with webcam footage of earlier victims. The FBI calls the scheme FaceStealer. It has seized more than 900 of those recordings, and on November 12 it warned crypto and web3 workers and open-source maintainers about the scheme.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.