The United States Justice Department said Thursday it had seized cloud infrastructure used by North Korean hackers in a video-call scam that has stolen more than $400 million (€361 million) in cryptocurrency over 18 months.
It also said it had court approval to seize or restrain more than $1.2 billion taken in the recent Binance hack.
The Federal Bureau of Investigation calls the scam "FaceStealer."
According to the Justice Department, hackers sent meeting invitations from accounts taken over from earlier victims. Once a target joins, the hackers record their webcam video and play a prerecorded clip of a previous victim the target knows, so trusted contacts appear to be present. The FBI says hackers are also starting to use AI-generated deepfakes of well-known crypto figures.
The hackers then stage a fake technical error and offer a link to "fix" it, which installs malware, the department said. In some cases, they waited months, or over a year, before stealing funds.
After that, they use the victim's contacts to find new targets.
To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video
Most targets work in crypto and other internet-related fields, and the hackers are increasingly going after open-source software developers, apparently to enable supply-chain attacks, the department said.
