---
title: FBI Seizes 900 Webcam Clips Behind North Korea’s Fake-Call Heists
description: Officials say North Korea’s state hackers replayed webcam clips of past victims in fake Zoom and Teams calls to steal over $400 million.
canonical_url: https://codekeeper.co/ticker/fbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Software security](https://codekeeper.co/ticker/tag/software-security)

# FBI Seizes 900 Webcam Clips Behind North Korea’s Fake-Call Heists

Officials say North Korea’s state hackers replayed webcam clips of past victims in fake Zoom and Teams calls to steal over $400 million.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 13, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

On November 12, 2026, the US Justice Department said it had taken down cloud servers behind FaceStealer, a North Korean scheme the FBI links to more than $400 million in stolen cryptocurrency over 18 months. Agents also seized more than 900 webcam recordings of victims, the raw material for the con. Here’s how it runs. An account hijacked from an earlier victim on Telegram, LinkedIn, Slack, or Discord invites a contact into a copycat Zoom, Teams, or Google Meet call. The attackers replay footage of people the target knows, sometimes adding AI deepfakes of crypto figures, then fake an audio glitch whose “fix” installs malware. Crypto and web3 workers are the main targets, but open-source maintainers are increasingly in the crosshairs, raising supply chain worries. The FBI ties the activity to groups tracked as APT38, BlueNoroff, and Sapphire Sleet, and says some thefts came more than a year after the first infection. Source: [BBC News](https://www.bbc.com/news/articles/cqdj1ellpd70o)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffbi-seizes-900-webcam-clips-behind-north-koreas-fake-call-heists%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Attacker Roots 21 N-central Servers, 19 Already on Latest Hotfix Nov 13, 2026](https://codekeeper.co/ticker/attacker-roots-21-n-central-servers-19-already-on-latest-hotfix)

[Cyberattacks Hijacked GitHub Accounts Plant a CI Secret Stealer, Then Wipe Logs Nov 13, 2026](https://codekeeper.co/ticker/hijacked-github-accounts-plant-a-ci-secret-stealer-then-wipe-logs)

[Cyberattacks One Toolmaker May Be Arming Three China-Nexus Espionage Campaigns Nov 13, 2026](https://codekeeper.co/ticker/one-toolmaker-may-be-arming-three-china-nexus-espionage-campaigns)

[Cyberattacks Hacker Defaces Victoria’s Exam Board Site Mid-Exams, Claims Leaks Nov 13, 2026](https://codekeeper.co/ticker/hacker-defaces-victorias-exam-board-site-mid-exams-claims-leaks)