[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0xshY-CG0nL6qajt3tfEt83ew1Og_VyICmTGZLhDRSg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"dbfbecba-4913-4cfa-ab00-235bfcbcd05b","north-korean-deepfake-zoom-scam-steals-400m-using-victims-own-webcam-footage","47a765fd-1d4c-4c0f-b21b-901e57084227","North Korean Deepfake Zoom Scam Steals $400M Using Victims' Own Webcam Footage","North Korean state-sponsored hackers exploited human trust by impersonating legitimate video call participants using stolen webcam recordings of previous victims, creating a self-reinforcing pool of deceptive footage. Each new victim's recording was harvested and recycled to deceive the next target, compounding the harm of every successful attack. The scheme specifically targeted cryptocurrency and Web3 workers, who frequently transact high-value assets with relatively low institutional oversight. This matters because it demonstrates that social engineering attacks can bypass technical controls entirely when users lack the awareness to verify the authenticity of who they are communicating with in real time.","**Immediate actions:**\n- Verify the identity of all video call participants through a secondary, out-of-band channel (e.g., a known phone number or encrypted message) before discussing sensitive topics or transactions.\n- Treat any unexpected or unsolicited invitation to a Zoom or Teams call involving cryptocurrency transactions as a high-risk event requiring escalation.\n- Train all crypto and Web3 staff to recognise signs of pre-recorded or deepfake video, such as unnatural blinking, lip-sync delays, or refusal to perform live spontaneous actions on request.\n\n**Long-term improvements:**\n- Establish a mandatory dual-approval process for any cryptocurrency transfer initiated or discussed over a video call.\n- Develop and enforce a written social engineering awareness policy that is reviewed and acknowledged by all staff annually.\n- Conduct regular simulated phishing and vishing exercises that include video-call-based scenarios to build staff muscle memory.\n\n**Detection measures:**\n- Implement endpoint monitoring to flag unauthorised access to webcam and microphone devices outside approved applications.\n- Maintain audit logs of outbound cryptocurrency transactions and flag those preceded by newly established or unverified video-call contacts.",[12,13,14,15,16],"MITRE ATT&CK T1566: Phishing","MITRE ATT&CK T1125: Video Capture","NIS2 Article 21(2)(g)","NIST SP 800-53 AT-2: Literacy Training and Awareness","ISO\u002FIEC 27001:2022 A.6.3: Information security awareness, education and training",{"NIS2 Article 21(2)(g)":18,"MITRE ATT&CK T1566: Phishing":19,"MITRE ATT&CK T1125: Video Capture":20,"NIST SP 800-53 AT-2: Literacy Training and Awareness":21,"ISO\u002FIEC 27001:2022 A.6.3: Information security awareness, education and training":22},"This point requires organisations to implement basic cyber hygiene and staff training, which would have equipped crypto\u002FWeb3 workers to recognise and resist sophisticated video-based social engineering attacks.","The attackers used deceptive fake Zoom\u002FTeams invitations to lure victims into fraudulent calls, which is a classic phishing-based initial access technique.","The scheme explicitly involved capturing victims' webcam footage during calls and reusing those recordings to deceive subsequent targets, matching this technique exactly.","This control requires organisations to provide security awareness training covering social engineering threats, which is the primary human-layer defence against this type of impersonation scheme.","This control mandates that personnel receive awareness training relevant to their role; targeted education for crypto workers on deepfake and video-impersonation risks would directly address the attack vector used here.","published","2026-11-13T08:22:15.566243+00:00","2026-11-13T08:22:15.551+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Ffbi-north-korean-fake-zoom-calls\u002F","stolen-webcam-clips-of-900-victims-feed-north-korea-s-400-million-fake-zoom-sche-c4b5f9","Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":38,"name":39,"slug":40,"description":41,"color":42},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[45,49,53],{"slug":46,"name":47,"problem":48},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]