Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1125: Video Capture

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen.

In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. [1]

EnterpriseT1125TechniqueObject v1.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Video Capture matters because it turns an endpoint peripheral or video application into an intelligence collection source. For leaders, the issue is not only malware recording a webcam; it is whether the organization can prove that camera-capable endpoints, conference-room systems, and user devices have enforceable access controls, usable telemetry, and an incident response path when unauthorized recording is suspected.

Executive priority

Prioritize this technique where sensitive discussions, regulated data, executive activity, operational facilities, or financial workflows occur near camera-enabled systems. The ATT&CK relationships show use by multiple groups and many remote access or spyware tools, so coverage should be treated as a privacy, insider-risk, espionage, and incident-readiness control question rather than a narrow malware signature problem.

Technical view

T1125 is a collection technique on Linux, macOS, and Windows. ATT&CK does not provide official detection text, but a related detection strategy, DET0197, is mapped to this technique. SOC and detection teams should validate whether they can observe unexpected processes interacting with camera devices or video-call applications, creation of image/video files by unusual processes, and subsequent staging or exfiltration context. Relationship context is important: many mapped software families are RATs, spyware, or post-exploitation frameworks, so detection should correlate video capture behavior with remote access, persistence, command-and-control, and file collection activity rather than relying on a single event.

Likely telemetry

  • Endpoint process telemetry for processes accessing camera devices or video-capture APIs
  • Operating system or application permission events for camera access where available
  • File creation telemetry for image or video artifacts written by unusual processes
  • Application logs from video call or camera-capable applications where available
  • EDR alerts or behavioral events associated with RAT/spyware activity

Detection direction

  • Validate DET0197-style behavior-chain coverage in the local environment; ATT&CK does not include native detection guidance for this technique.
  • Tune for unusual parent/child process relationships and non-business processes accessing camera devices or producing media files.
  • Baseline approved video applications to reduce false positives from normal conferencing, recording, accessibility, or support tools.
  • Correlate video capture indicators with mapped software context such as RATs, spyware, and post-exploitation frameworks rather than treating camera access alone as conclusive malicious activity.
  • Check blind spots on endpoints without camera permission logging, unmanaged peripherals, conference-room systems, and systems where EDR visibility is limited.

Mitigation priorities

  • Inventory camera-enabled endpoints and systems in sensitive business areas.
  • Restrict camera access to approved applications and users where platform controls allow it.
  • Apply least-privilege and application-control principles to reduce unauthorized RAT, spyware, or post-exploitation tool execution.
  • Review endpoint hardening and privacy settings across Linux, macOS, and Windows rather than assuming a single platform policy covers all cases.
  • Ensure incident response procedures include privacy, legal, communications, and evidence-handling steps for suspected unauthorized recording.
Analyst notes and limits

The object is a collection technique, not an exploit or vulnerability. Its importance comes from the sensitivity of what may be observed and from its repeated mapping to groups and software in ATT&CK, including FIN7, Silence, Ember Bear, VOID MANTICORE, and multiple RAT/spyware families. Local risk depends heavily on where cameras exist, what users do near them, and whether endpoint telemetry records camera access or media creation.

Official ATT&CK detection guidance is not provided for T1125, and the relationship to DET0197 does not include detection details in the supplied fields. This take does not assert current activity, customer exposure, or guaranteed detection. Control and telemetry recommendations must be validated against the organization’s actual platforms, applications, privacy settings, and logging capabilities.

Official MITRE ATT&CK definition

Video Capture

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen.

In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G1003: Ember Bear

Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).[1] Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.[2] Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.[3][4][1] There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.[2][5]

Group Enterprise

G0091: Silence

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.[1][2]

Group Enterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

Group Enterprise

G1055: VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]

Tool Enterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
Malware Enterprise

S0467: TajMahal

TajMahal is a multifunctional spying framework that has been in use since at least 2014. TajMahal is comprised of two separate packages, named Tokyo and Yokohama, and can deploy up to 80 plugins.[1]

Windows
Malware Enterprise

S0336: NanoCore

NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.[1][2][3][4]

Windows
Malware Enterprise

S0283: jRAT

jRAT is a cross-platform, Java-based backdoor originally available for purchase in 2012. Variants of jRAT have been distributed via a software-as-a-service platform, similar to an online subscription model.[1] [2]

LinuxWindowsmacOS
Malware Enterprise

S0385: njRAT

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.[1]

Windows
Relationship explorer

All related ATT&CK context

uses · Tool S0363: Empire Enterprise uses · Malware S0660: Clambling Enterprise uses · Malware S0115: Crimson Enterprise uses · Malware S0467: TajMahal Enterprise uses · Malware S0338: Cobian RAT Enterprise uses · Malware S0336: NanoCore Enterprise uses · Malware S0283: jRAT Enterprise uses · Malware S0409: Machete Enterprise detects · Detection Strategy DET0197: Behavior-chain, platform-aware detection strategy for T1125 Video Capture Enterprise uses · Malware S0379: Revenge RAT Enterprise uses · Malware S0334: DarkComet Enterprise uses · Malware S0385: njRAT Enterprise uses · Malware S0331: Agent Tesla Enterprise uses · Group G1003: Ember Bear Enterprise uses · Malware S0428: PoetRAT Enterprise uses · Group G0091: Silence Enterprise uses · Tool S0434: Imminent Monitor Enterprise uses · Tool S0591: ConnectWise Enterprise uses · Malware S0152: EvilGrab Enterprise uses · Malware S0265: Kazuar Enterprise uses · Tool S1087: AsyncRAT Enterprise uses · Malware S0461: SDBbot Enterprise uses · Group G0046: FIN7 Enterprise uses · Tool S1209: Quick Assist Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
5fbfdc7d2557c6fc...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.2 Current bundle 5fbfdc7d2557…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    objective-see 2017 review

    Patrick Wardle. (n.d.). Retrieved March 20, 2018.

    Open source URL
  2. [2]
    mitre-attack T1125
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use