Stolen webcam clips of 900+ victims feed North Korea's $400 million fake Zoom scheme

North Korean state-sponsored hackers have conducted a sophisticated social engineering campaign called FaceStealer, stealing over $400 million in cryptocurrency over 18 months. The attackers compromise legitimate accounts on platforms such as Telegram, LinkedIn, Slack, and Discord to invite targets to fake Zoom or Teams meetings. These calls use stolen webcam footage of previous victims to create the illusion of legitimate participants. Attackers then trick victims into running malicious scripts that install cookie harvesters, keyloggers, screen capturers, and backdoors. The campaign targets cryptocurrency wallet holders, web3 workers, and open-source maintainers, sometimes waiting months or more before stealing funds.

• North Korea's Crypto Heists Start on the Open InternetMalware2026-10-31
• Binance heist: what we know, and what we see in TraderTraitor's toolkitMalware2026-11-05
• Luna Moth Returns, Re-Targeting Law Firms Through Access TokensCampaign2026-11-12
• 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RATMalware2026-11-13
• Fake Zillow pages use ClickFix NetSupport RAT to target apartment huntersMalware2026-11-13