[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNVeAxGn1gqaBDgUfx70mqkUcePN6PDYtPQunGtdUiM4":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"47a765fd-1d4c-4c0f-b21b-901e57084227","Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme","stolen-webcam-clips-of-900-victims-feed-north-korea-s-400-million-fake-zoom-sche-c4b5f9","North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and Teams calls filled with webcam footage of earlier victims. The FBI calls the scheme FaceStealer. It has seized more than 900 of those recordings, and on November 12 it warned crypto and web3 workers and open-source maintainers about the scheme. Source: FBI Every successful call infects the target and records them, … More → The post Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme appeared first on Help Net Security.","North Korean state hackers have stolen over $400 million in cryptocurrency in the last 18 months by luring victims into fake Zoom and Teams calls. These calls feature stolen webcam footage of previous victims, with each new victim's recording added to the pool. The FBI, which calls the scheme FaceStealer, has seized over 900 recordings and warned crypto and web3 workers about the threat.","North Korean hackers stole $400M+ using fake Zoom calls with victim webcam footage.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Ffbi-north-korean-fake-zoom-calls\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F13072144\u002Fface-north_korea.webp","2026-11-13T06:30:30+00:00","2026-11-13T08:00:19.212132+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"Sapphire Sleet","threat_actor",{"name":21,"type":19},"BlueNoroff",{"name":23,"type":19},"APT38",{"name":25,"type":26},"Zoom","product",{"name":28,"type":26},"Teams",{"name":30,"type":31},"JavaScript","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"domain","uu01webzoom.us","Lookalike domain used for fake meeting invites.",{"type":49,"value":61,"context":62},"FaceStealer","FBI's name for the scheme involving cookie harvesters, keyloggers, screen capturers, and backdoors.",[25],{"controls":65,"vendors":147},[66,95,121],{"slug":67,"name":68,"problem":69,"products":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,105,113],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":101,"product_name":102,"url":103,"description":104},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":122,"name":123,"problem":124,"products":125},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[126,134,141],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":122,"product_name":138,"url":139,"description":140},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":142,"product_name":143,"url":145,"description":146},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":158},"north-korean-deepfake-zoom-scam-steals-400m-using-victims-own-webcam-footage","North Korean Deepfake Zoom Scam Steals $400M Using Victims' Own Webcam Footage","North Korean state-sponsored hackers exploited human trust by impersonating legitimate video call participants using stolen webcam recordings of previous victims, creating a self-reinforcing pool of deceptive footage. Each new victim's recording was harvested and recycled to deceive the next target, compounding the harm of every successful attack. The scheme specifically targeted cryptocurrency and Web3 workers, who frequently transact high-value assets with relatively low institutional oversight. This matters because it demonstrates that social engineering attacks can bypass technical controls entirely when users lack the awareness to verify the authenticity of who they are communicating with in real time.",[153,154,155,156,157],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1125: Video Capture","NIS2 Article 21(2)(g)","NIST SP 800-53 AT-2: Literacy Training and Awareness","ISO\u002FIEC 27001:2022 A.6.3: Information security awareness, education and training",{"NIS2 Article 21(2)(g)":159,"MITRE ATT&CK T1566: Phishing":160,"MITRE ATT&CK T1125: Video Capture":161,"NIST SP 800-53 AT-2: Literacy Training and Awareness":162,"ISO\u002FIEC 27001:2022 A.6.3: Information security awareness, education and training":163},"This point requires organisations to implement basic cyber hygiene and staff training, which would have equipped crypto\u002FWeb3 workers to recognise and resist sophisticated video-based social engineering attacks.","The attackers used deceptive fake Zoom\u002FTeams invitations to lure victims into fraudulent calls, which is a classic phishing-based initial access technique.","The scheme explicitly involved capturing victims' webcam footage during calls and reusing those recordings to deceive subsequent targets, matching this technique exactly.","This control requires organisations to provide security awareness training covering social engineering threats, which is the primary human-layer defence against this type of impersonation scheme.","This control mandates that personnel receive awareness training relevant to their role; targeted education for crypto workers on deepfake and video-impersonation risks would directly address the attack vector used here."]