North Korean hackers steal $400M via fake Zoom calls using stolen webcam clips

Tier D · Background noise – Good to know

Who’s exposed: Developers and crypto holders receiving fake Zoom or Teams calls

Tier D because: Does not hit tech teams

Reach

Attack

Damage

Fix

Exploited in the wild · Secrets exposed

The Brief

North Korean state hackers stole more than $400 million in cryptocurrency over the past 18 months.
Targets were pulled into fake Zoom and Teams calls filled with webcam footage of earlier victims.
The FBI calls the scheme FaceStealer and says it has seized more than 900 such victim clips.

Why it matters

Developers and crypto holders can be lured into fake video calls that use real footage of other people, so unexpected meeting invitations should be treated with suspicion.

The checklist behind the tier

Checklist · 2 of 10 yes

No	Hits tech teams	Judgment: scam via fake Zoom/Teams calls; Zoom itself not breached, so phishing exception applies.
No	Core infrastructure	Judgment: brands are only impersonated; no core infrastructure software is flawed or compromised.
No	Popular tool	Judgment: Zoom and Teams are only impersonated, not flawed or compromised.
Yes	Exploited in the wild	Help Net Security: North Korean hackers stole over $400 million via fake Zoom and Teams calls.
No	Public exploit	Help Net Security describes a social engineering scheme; no published exploit code or PoC mentioned.
No	Remote, no login	Help Net Security: targets must be pulled into fake calls, requiring victim interaction.
No	Full takeover	Help Net Security reports crypto theft and webcam footage; no code execution or admin takeover stated.
Yes	Secrets exposed	Help Net Security: stolen webcam clips of 900+ victims were seized by the FBI-named FaceStealer scheme.
No	Supply chain	Help Net Security describes fake calls; no compromised package, update or build pipeline mentioned.
No	No fix yet	Help Net Security describes a social engineering campaign, not a vulnerability awaiting a patch.

Source

Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme ↗ Help Net Security · 1h ago

First seen 1h ago · 1 source · Full story page · How tiers are decided