Deepfakes and crypto: the North Korean fraud that deceives via video call

The FBI has concluded that actors linked to North Korea have stolen more than 400 million dollars in cryptocurrencies over the past 18 months through a social engineering scheme dubbed FaceStealer. The main vector is not a software flaw or a zero-day exploit: it is a video call. Attackers impersonate trusted individuals using generated or manipulated video to convince their victims to authorize transfers, share credentials, or open access to their systems.

The news is part of a package of coordinated actions by the U.S. Government, which includes measures on cloud services. For a Spanish SME, the temptation is to think this is a problem for exchanges and large funds. That is a misguided approach: the mechanism —trusting a familiar face on screen— is exactly the same one used today by IBAN change frauds, urgent payment requests from the "CEO," or remote support access requested by phone.

What changes with synthetic video

Until recently, CEO fraud was detected by the tone of the email or by a strange voice on the phone. Real-time video eliminates that friction: the victim sees a person they recognize, with their appearance and way of speaking, and lowers their guard. In small organizations, where personal trust weighs more than procedures, that leap is especially dangerous.

It is worth separating two levels. The first is the direct theft of cryptoassets, which affects those who custody keys or authorize operations with them. The second, more relevant for most SMEs, is the use of deepfakes as an entry point to corporate credentials, email accounts, billing tools, or administration panels. Once inside, the attacker does not need crypto: they can divert payments, request financing in the company's name, or install persistence.

Why an SME should review its procedures

• Out-of-channel authorization. Any payment instruction or change of bank details must be confirmed through a second, independent channel, never on the same call or in the same email thread.
• Dual signature on sensitive operations. If a single person can move money or grant administrative access, the control is decorative.
• Identity verification in remote support. IT teams receive access requests; it is advisable to require identification and a prior ticket, as we already discussed when talking about SCKit and ScreenConnect.
• Account hygiene. Phishing-resistant MFA, review of active sessions, and alerts for anomalous logins.
• Training with real examples. Showing a manipulated video is worth more than a ten-page security policy.

The human factor cannot be patched, it must be trained

The lesson of FaceStealer is uncomfortable: defensive technology alone does not stop a convincing conversation. What stops fraud is process. An employee who knows that they must always hang up and call a known number before authorizing a transfer is more effective than a state-of-the-art antivirus against this type of attack.

Visual identity is no longer proof of identity. Trust must rest on verifiable procedures, not on what we see on screen.

It is also worth reviewing the exposure of AI tools and automations, a front we already addressed in AI agents that break security rules. The more assistants and delegated accesses we have, the more surface there is for an impersonation to lead to a real action.

What we recommend doing this week

1. Define in writing the verification procedure for payments and changes of bank details, with a mandatory alternative channel.
2. Review who has administrator permissions and reduce that list to the essential minimum.
3. Enable access alerts and review open sessions in email, banking, and cloud panels.
4. Deliver a 20-minute training session with examples of impersonation by video and voice.
5. Test the procedure with an internal simulation: if no one detects the attempt, there is room for improvement.

You do not need to be a strategic target to fall for a scam of this type. It is enough for an attacker to find a person with access and in a hurry. The good news is that defense does not require huge budgets: it requires judgment, processes, and a bit of healthy skepticism.

Source: The Hacker News. Analysis and adaptation: ForgeNEX.