Procedure examples

EvilGrab has the capability to capture video from a victim machine.

Crimson can capture webcam video on targeted systems.

Machete takes photos from the computer’s web camera.

InvisiMole can remotely activate the victim’s webcam to capture content.

Kazuar captures images from the webcam.

DarkComet can access the victim’s webcam to take pictures.

ObliqueRAT can capture images from webcams on compromised hosts.

Clambling can record screen content in AVI format.

Bandook has modules that are capable of capturing video from a victim's webcam.

T9000 uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.

SDBbot has the ability to record video on a compromised host.

Derusbi is capable of capturing video.

Cobian RAT has a feature to access the webcam on the victim’s machine.

NanoCore can access the victim's webcam and capture data.

TajMahal has the ability to capture webcam video.

Revenge RAT has the ability to access the webcam.

PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.

ZxShell has a command to perform video device spying.

njRAT can access the victim's webcam.

Agent Tesla can access the victim’s webcam and record video.

jRAT has the capability to capture video from a webcam.

WarzoneRAT can access the webcam on a victim's machine.

Empire can capture webcam data on Windows and macOS systems.

PcShare can capture camera video as part of its collection process.

AsyncRAT can record screen content on targeted systems.

Remcos can access a system’s webcam and take pictures.

ConnectWise can record video on remote hosts.

Imminent Monitor has a remote webcam monitoring capability.

Pupy can access a connected webcam and capture pictures.

QuasarRAT can perform webcam viewing.

Quick Assist allows for the remote administrator to view the interactive session of the running machine, including full screen activity.