FBI says North Korea-linked hackers stole more than $400 million using AI deepfake video calls
The FBI says hackers linked to North Korea stole more than $400 million over the past 18 months through a scheme that used identity theft and AI-manipulated video calls. The operation, which the bureau has dubbed FaceStealer, relied on social engineering to trick victims into opening the door to malware. According to the FBI, the money was used to help finance the North Korean weapons programme.
Advert for a company owned by the publisher of 360LiveNews.
In a statement issued on Thursday, Brett Leatherman, who leads the FBI's cyber division, said the group used fake video calls to impersonate someone known to the target. The calls reportedly used deepfake videos to make the contact appear genuine, before the attackers simulated a technical error and pushed the victim to click a link or message. That step allowed malware to be installed on the device, giving the hackers access to contacts, social media accounts and messaging apps.
The FBI said it has found more than 900 webcam videos belonging to victims of the FaceStealer operation. It said the attackers then used those materials to reach new targets, extending the campaign through victims' own networks. The bureau described the theft as recent and ongoing over the last 18 months, indicating a sustained effort rather than a single breach.
The case adds to long-running concerns about North Korea's use of cyber operations to generate funds under sanctions pressure. Western governments have repeatedly accused Pyongyang of using hacking to support state priorities, including weapons development. The FBI's latest allegation places artificial intelligence at the centre of that effort, showing how deepfake tools can be combined with older forms of fraud to increase the reach of cyber theft.
Advert for a company owned by the publisher of 360LiveNews.
The row also comes as the FBI this month accused another North Korea-linked group of stealing a much larger sum from a cryptocurrency platform, an allegation Pyongyang denies. Together, the claims point to a broader pattern of cyber activity that US officials say is tied to state financing. They also highlight the growing challenge for companies and individuals trying to verify identity in video-based communications.
What remains unclear is how much of the stolen money has been recovered, and whether any arrests or disruptions have been made against the network behind FaceStealer. The FBI has not said where the victims were located or how many organisations were affected. The key question now is whether the campaign is still active and whether other agencies will issue similar warnings as the tactics spread.
