The FBI says it disrupted infrastructure North Korean hackers used to target crypto and Web3 workers with fake video meetings. The attackers reportedly hijacked Telegram and LinkedIn accounts to pose as trusted industry contacts, then pushed victims to install malware.
The FBI has disrupted infrastructure used by North Korean hackers in a social engineering scheme aimed at crypto and Web3 workers. According to the bureau, the attackers used fake Zoom and Microsoft Teams meetings to record victims' webcams, install malware, and impersonate experienced industry professionals.
How the fake meetings worked
Jeremy Robertson, the special agent in charge of counterintelligence and cyber at the FBI's Los Angeles field office, described the scheme in a video on X. He called it FaceDealer.
According to Robertson, the attackers usually messaged potential victims while impersonating someone the target knew or recognized as important in the industry. The contact often looked legitimate because the hackers had hijacked that person's social accounts, including Telegram or LinkedIn.
Next, the attackers lured the victim into a fake but realistic-looking Zoom or Teams meeting that they had built and fully controlled. Robertson said the hackers secretly recorded the victim's webcam while the victim waited for the meeting to start, so they could later impersonate the victim.
A fake error leads to malware
When the meeting began, the victim saw webcam video of the person who supposedly sent the invitation. That person was not there, however, and the video came from an earlier victim.
To add pressure, Robertson said the scammers often added a few extra fake participants and messaged the victim that the other party had trouble hearing them. The hackers then generated a fake error message saying the victim needed to run an update.
Victims who ran the fake update unwittingly downloaded malware, which gave the attackers access to their computer, crypto wallets, and even social media accounts.
Source: CryptoPotato
Trading involves risk.
Risk Disclaimer
