Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme

FBI has taken action against webcam clips, according to the latest reporting on the case.

North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and Teams calls filled with webcam footage of earlier victims.

It has seized more than 900 of those recordings, and on November 12 it warned crypto and web3 workers and open-source maintainers about the scheme.

Every successful call infects the target and records them, so each new victim becomes the familiar face on the next call.

Confirm the meeting through a second channel, for example a phone call when the invite came over Telegram.

If you suspect a compromise, create a new wallet on a clean device and move everything into it.

Past victims of webcam clips are not made whole by this action alone, and anyone still running systems compromised before this action remains affected.

The hackers take over earlier victims’ Telegram, LinkedIn, Slack and Discord accounts, read their chat histories, and message the victims’ contacts about catching up or an investment.

Stolen footage of real victims still makes up the overwhelming share of the scheme.

An arrest or a seized domain disrupts the operation, but it doesn't undo what already happened to that operation's past victims, and it rarely accounts for every affiliate who can simply rebrand.

This is still an active investigation, not a settled case -- the specifics here may firm up, soften, or change entirely as more comes out.

The hackers go after computers that hold a crypto wallet, a seed phrase, or access to an employer’s network or a code repository.

This action was brought by FBI, which is the body to watch for further updates.

webcam clips is now dealing with an active legal process, with FBI leading the action.

If your environment shows any indicators associated with webcam clips, don't assume this action alone removed that exposure -- check for persistence regardless of the takedown.

Treat this as a disruption worth noting, not a reason to deprioritize monitoring for the same group's affiliates or rebrands.