Introduction

In April 2026, police in Pan'an, Zhejiang Province issued a public alert: a corporate finance officer received a real-time video call from the "boss" demanding a transfer of RMB 5 million. The face, voice, and tone on screen were nearly identical to the real executive—later confirmed to have been entirely AI-generated^[1]. This case is not isolated. Similar tactics emerged in Changzhou, Hubei, and other regions throughout 2025. The rapid shift from pre-recorded deepfakes to real-time interactive forgeries—a transition largely completed between 2024 and 2025—has made AI video call fraud one of the fastest-growing cybercrime categories in 2025–2026. The FBI Internet Crime Complaint Center (IC3) dedicated a standalone AI section in its 2025 annual report, disclosing 22,364 AI-related complaints^[2]with losses of approximately USD 893 million^[3]—merely the tip of the iceberg. INTERPOL's 2026 report further notes that AI-enhanced fraud operations are up to 4.5 times more profitable than traditional methods^[4].

Cases continue to spike, yet the public rarely sees complete attack details—companies avoid disclosure to protect reputation, police investigations remain confidential, and media coverage is constrained by sourcing limitations. This information asymmetry creates a paradox:we "know it's dangerous," but we "don't know what the danger looks like."How does the technical kill chain operate? Why do defenses repeatedly fail? And how should enterprises and individuals respond given the lack of granular detail?

This article does not attempt to reconstruct any single case in full. Instead, it assembles a generic attack model for AI real-time video call fraud from fragmented alerts and publicly available technical sources, and explores how the public can establish minimum-cost defenses.

I. Piecing Together the Puzzle: Common Characteristics of AI Video Call Fraud

1.1 Shared Traits Across Multiple Cases

Reviewing publicly disclosed domestic cases: In April 2026, a finance officer in Pan'an, Zhejiang received a real-time video call from the "boss" demanding a RMB 5 million security deposit transfer. In 2025, a finance intern in Changzhou was deceived by an AI-synthesized voice mimicking the boss's regional dialect, losing RMB 300,000. In April 2023, Mr. Guo in Fuzhou was defrauded of RMB 4.3 million by an AI face-swapped "friend" citing a bidding emergency. Multiple police bulletins also report victims receiving video calls from a "son" requesting urgent transfers, later discovering the account was compromised.

In 2024, global design and engineering firm Arup fell victim to a deepfake fraud in Hong Kong. Attackers had pre-produced deepfake videos of several executives, played them sequentially during a video conference, and paired them with precise social-engineering scripts to induce a finance officer to transfer HKD 200 million. In another case the same year, Hong Kong Police dismantled a cross-border fraud hub in a Hung Hom industrial building where criminals used AI deepfakes to disguise male operatives as affluent women on social platforms, running romance-investment ("pig butchering") scams totaling over HKD 360 million^[5].

Despite varying scenarios, the underlying attack patterns are remarkably consistent. Attackers target finance officers or decision-makers with fund-transfer authority; impersonate executives or relatives via real-time video or voice cloning; craft scripts emphasizing "urgency + confidentiality" to bypass normal approval workflows; and manufacture intense time pressure so victims cannot verify through other channels. Prior reconnaissance through public channels—corporate announcements, social media—allows attackers to assemble daily habits and contextual details that make fraudulent scripts highly convincing.

Synthesizing these traits:AI video call fraud has rapidly evolved from "proof-of-concept" to "precision-targeted" attacks. Corporate finance staff, international students, and cross-border business travelers are now in the crosshairs.

1.2 The Attacker's Five-Step Model

Based on commonalities across cases and threat intelligence published by security vendors, the standard attacker workflow can be broken into five steps:

1. Biometric Harvesting:Collect clear frontal facial images and voice samples of executives from open-source intelligence (corporate websites, annual meeting livestreams, social media), or implant info-stealers via phishing emails and fake meeting links. A casual selfie video or an interview recording on social media can all become source material.
2. Model Deployment and Forgery:Using publicly available pre-trained models from the open-source community, attackers need only complete environment setup and lightweight fine-tuning to achieve real-time face swapping and voice cloning. AI has dramatically accelerated this—one photo and a few seconds of original voice can yield highly convincing visuals and speech, with real-time inference feasible on consumer-grade hardware.
3. Social Engineering Reconnaissance:Crawl corporate announcements, supply-chain relationships, and organizational charts; track target posts including travel geotags and office group photos to assemble an information mosaic that makes fraudulent scripts contextually authentic.
4. Real-Time Video Call Phishing: Initiate calls over common instant-messaging platforms, delivering urgent transfer instructions in the tone of a "supervisor" or "relative," using high-pressure scripts to impair the victim's judgment.
5. Rapid Fund Movement:Launder proceeds through layered accounts, cryptocurrency, gold, or luxury goods purchases.

Behind this five-step model lies an unsettling reality: these technical capabilities are now widely available globally. An ordinary individual can produce a relative-convincing forged video at minimal cost and within a short timeframe.The precipitous drop in the barrier to entry is the root cause of the concentrated surge of such scams in 2025–2026.

1.3 Why Details Are Missing: The Spiral of Silence

Having mapped the attack model, a thornier question surfaces: with so many cases occurring, why does the public rarely see complete attack details (call transcripts, transfer screenshots, or fund flows)?

Companies fear reputational damage, stock price impacts, and client attrition, preferring private recovery over public reporting; law enforcement must maintain investigative confidentiality to avoid large-scale copycat attacks; and media outlets lack authorized sources for in-depth coverage. These three parties' individually rational silences create a vicious cycle:fewer cases publicized → weaker public awareness → thinner defenses → more victims.The following technical sections explain that this information gap is not accidental—it is a critical backdrop to understanding current defense dilemmas.

II. The Technical Threat: How Real-Time Forgery Went Mainstream

Since the details of these cases have not been made public, the following technical descriptions are based on open security research, vendor reports, and open-source project documentation.

To understand why AI-powered video call fraud surged in 2025–2026, it helps to first examine the technical toolkit now available to attackers. Over the past two years, three key capabilities have moved from the lab into the hands of ordinary users: real-time face swapping, real-time voice cloning, and the ability to reliably disguise video streams within common messaging apps. Below, we break down how each works and what threats they pose.

2.1 Real-Time Face Swapping: From One Photo to a Fluid Video Call

The core ofreal-time face swappingis converting a static photo into a fluid video-call feed. The pipeline includes face detection, feature extraction, facial blending, and real-time rendering. Before 2024, this required high-end hardware and hours of parameter tuning; today, open-source one-click face-swapping solutions achieve fluid real-time output on consumer-grade GPUs with latency below human perceptual thresholds—head turns and blinks during a call are nearly impossible to detect as anomalous. Achieving fluid dynamic face swapping in a livestream or real-time video feed no longer demands extreme hardware; even an ordinary consumer PC with a discrete GPU can now handle real-time tasks smoothly.

2.2 Voice Cloning: Replicating a Person from Seconds of Audio

The goal ofreal-time voice cloningis to replicate an individual's voice from a few seconds of samples and deliver low-latency conversational responses. For a long time, this capability was held by a handful of tech giants, locked behind proprietary APIs with high costs. In early 2026, an open-source breakthrough changed that landscape. For the first time, an open real-time voice-cloning solution put this capability in everyone's hands: it requires only 5–10 seconds of clear speech, delivers latency low enough for natural dialogue, and can mimic regional accents and emotional tone. Today, attackers can run a full cloning pipeline on personal devices at negligible computational cost.

2.3 Real-Time Video Filtering: Keeping Forged Footage Seamless in Messaging Apps

Video-stream camouflagesolves the engineering problem of deployment. Common instant-messaging tools (e.g., WeChat, WhatsApp) compress and resample video streams; pushing raw forged frames directly can produce edge flicker, unstable frame rates, and other telltale artifacts. Attackers use virtual camera technology to disguise the forged stream as a genuine camera input, supplemented by real-time post-processing to withstand platform compression. Optimized solutions can run stably inside common messaging apps at frame rates imperceptible to ordinary users.

On underground markets, voice-cloning services can be purchased for minimal cost, while high-definition real-time face-swapping packages cost only slightly more—no programming background required, and convincing audio/video can be generated within minutes. Once attackers solved the engineering challenge of real-time forgery, ordinary people could no longer distinguish real from fake in routine video calls. This is the core reason for the sharp rise in success rates.

Each of the three capabilities, used alone, has fatal flaws: face swapping without matched voice produces lip-sync misalignment; voice cloning without video fails to establish visual trust; and even combined, a stream that stutters or flickers under platform compression will immediately expose the ruse. Therefore, early attacks in 2024–2025 often leveraged only one vector, limiting success. The true inflection point arrived in 2025–2026, when attackers engineered low-latency synchronization of all three. The timeline below traces how this combination matured from one-way forgery to bidirectional real-time interaction—and why this year became the outbreak tipping point.

III. Tactical Evolution: From One-Way Forgery to Real-Time Interaction

3.1 The Evolution Path to Date

Stringing the above technical capabilities along a timeline reveals a clear trajectory of iterative tactics:

• Pre-2019 (Pure Social-Engineering Stage):
  Fraud relied almost entirely on manual phone scripts (impersonating relatives, supervisors, or law enforcement). No technical forgery; victims could easily debunk by calling back.
• 2019–2021 (AI Fraud Embryonic Stage):
  First AI voice-cloning fraud appeared; China's Ministry of Public Security (MPS) issued alerts in 2021. High technical barrier; cases remained isolated. Marked the shift from "pure SE" to "technology-enhanced" fraud.
• 2022–2023 (Voice-Cloning Abuse Stage):
  AI voice cloning spread rapidly—3–30 seconds of sample audio sufficient. Used in "virtual kidnapping" and "emergency assistance" scams; early non-real-time AI face-swapped celebrity impersonations emerged. Notable case: Fuzhou victim Mr. Guo lost RMB 4.3 million to an AI face-swapped friend in April 2023. FBI and other agencies issued dense warnings.
• 2024 (Multi-Actor Coordinated Forgery Stage):
  Industrialized deepfakes entered live operations. Representative case: Arup's pre-recorded video conference fraud, where multiple "executives" sequentially demanded transfers, causing HKD 200 million in losses. Attacks scaled from 1-on-1 to multi-actor coordination, but video remained pre-recorded, lacking real-time interaction.
• 2025 (Industrialization and Scaling Stage):
  AI achieved synchronized voice + video forgery with low-latency real-time interactivity. Deepfake face-replacement attacks grew significantly year-over-year; police data across multiple regions showed a rapid upward trend, and the fraud threat escalated markedly. Victims could no longer rely on "on-the-spot questions" to verify authenticity^[6]. Multiple provincial consumer councils issued warnings on AI-fusion fraud.
• 2026–Present (Democratization and Mass Exploitation Stage):
  Real-time deepfake tools became widely accessible on consumer-grade devices, pushing fraud into an "unverifiable by intuition" phase. Attack scope expanded from targeted operations to mass socialized fraud (deepfake advertisements, fake real-name authentication), alongside novel attacks using AI dynamic video to defeat facial-recognition systems. Countermeasures evolved in parallel (detection within seconds, high accuracy).

The driver of this evolution is modular tool-chain packaging and the proliferation of tutorials. In 2024, deploying real-time face swapping required high-end hardware and hours of tuning; today, an ordinary device plus a one-click script suffices.The cliff-like collapse of the skill barrier allowed fraud syndicates to replicate attack capabilities at scale, producing the sharp case spike in 2026.

3.2 Projected Next-Phase Trends

INTERPOL's 2026 report warns^[4]that "agentic AI" can alreadyautonomously plan and execute complete fraud workflows from reconnaissance to extortion, with AI-enhanced scams far outpacing traditional profitability.

The core future shift may not be "forging more convincingly," but ratherattackers systematically manipulating the entire chain of trust. Previously, the goal was to make the victim believe one person. In the future, attacks will simultaneously forge voice, video, email, instant messaging, and even internal approval records. These multiple channels will cross-corroborate, leading victims to conclude "this is real" even after repeated verification. Traditional safeguards—callback confirmation, video verification, acquaintance recognition—are gradually failing because the target has shifted from identity to trust environment. Meanwhile, as AI agents mature, fraud is transitioning from manual execution to automated operation: models proactively analyze target backgrounds, relationship networks, and behavioral habits to dynamically generate the most persuasive scripts and action paths, "playing a role" over extended periods for sustained, low-noise infiltration.

As of May 2026, no publicly disclosed attack cases have confirmed that this type of "full-environment" AI-autonomous fraud has actually occurred. This section is a logical projection based on agentic AI technology and current attack patterns, intended as early warning of potential directions rather than a declaration of confirmed threat.

3.3 The Broader AI Attack Context and Threat Actor Profiles

The widespread use of generative AI tools is accelerating the evolution of the entire cybercriminal ecosystem. Among crime modalities, fraud absorbs AI capabilities fastest and causes the most severe harm because it offers the shortest cash-out path. The deeper transformation is that AI is upgrading fraud from "individual deception" to systematic trust manipulation. The combination of generative models with voice/video synthesis allows attackers to cheaply mass-produce voices, faces, and behavioral habits, presenting them synchronously across email, phone, and video conferences to construct a communication environment that "looks completely real"—rendering traditional verification mechanisms (callback confirmation, video verification, acquaintance recognition) progressively obsolete. The introduction of AI agents further automates and sustains attacks: models automatically harvest target information, analyze relationship networks, and adjust scripts in real time, enabling long-term "role-play infiltration." The ultimate consequence is not merely financial loss, but the systematic destruction of internal trust architectures.

Who is behind these attacks?Globally, independent threat actors tracked by security vendors fall clearly into two categories.

• State-sponsored APT groups(including Lazarus Group, BlueNoroff, and others). According to multiple public vendor reports, these actors have a clear objective—stealing cryptocurrency to evade international financial sanctions. Their tactics include using AI-synthesized video to impersonate identities in fake video conferences, tricking targets into installing malware to steal wallet keys; and using AI-generated video content to lure cryptocurrency industry professionals, with targets spanning over 20 countries. Public data indicates that in 2025 alone, network attacks linked to this background netted approximately USD 2.02 billion in stolen assets^[8].
• Purely profit-driven transnational criminal syndicateswith no political agenda. These groups operate an industrialized"Fraud-as-a-Service"model: distributing malware via fake video-generator websites; maintaining criminal networks across Southeast Asia; and employing tactics including AI face-swapped official impersonation, AI-disguised relative "virtual kidnapping," and AI-driven pig-butchering scams. The drastic reduction in technical barriers allows these syndicates to replicate attack capabilities at minimal cost and massive scale.

The existence of these two actor classes demonstrates thatAI fraud has escalated from scattered hacker activity to a systemic threat driven jointly by nation-state resources and transnational criminal organizations. Defenders face not merely a technical challenge, but organized, well-resourced, and highly motivated adversaries.

IV. Defense Guide: Default Distrust and Three Iron Rules

4.1 Reassessing the Trust Value of Biometrics

"AI face swapping and voice cloning have heavily devalued the trustworthiness of biometrics in remote video-call scenarios." This is the more accurate formulation. The fuller assessment:in unverified video-call scenarios, face and voice have significantly declined as reliable identity credentials, though they are not completely invalid in all contexts.For example, biometrics retain value in environments with physical presence or high-quality multimodal sensors (in-person meetings, dedicated secure terminals); and hardware-level tamper-resistant biometric capture may partially restore trust in the future. However, in ordinary video calls—the most common remote interaction scenario—face and voice can no longer serve as trustworthy proof. Therefore, defense logic must pivot from "spotting fakes" to"assuming all remote instructions could be fake, and mandating independent-channel verification."

4.2 Core Defensive Principles: Immediately Actionable Measures

Balancing reliability, usability, and resilience, we distill defenses into three tiers. The core objective:make defensive principles simple enough to remember, and reliable enough to materially reduce risk.

Tier 1: Core Principle—Hang Up and Call Back

Out-of-Band (OOB) Callback Verification:End the video call, then use a pre-registered alternate communication tool (different number, different device, different platform) to actively call back and verbally confirm the instruction's authenticity. Attackers are extremely unlikely to simultaneously control two physically isolated channels. (As of May 2026) we are not aware of any publicly disclosed case or security study demonstrating an attacker successfully hijacking two physically isolated communication channels in a single fraud attempt. However, defenders should remain vigilant against SIM-swapping attacks that could compromise a single out-of-band channel. This approach currently constitutes a high-reliability defense, though risks such as SIM swapping that compromise the OOB channel itself must be guarded against.

The Lowest-Cost Measure for Enterprises and Families:Agree with executives, finance staff, and family members thatanytransfer request made during a video call must be followed by hanging up and calling back on a separately saved number. This measure costs nothing yet blocks the vast majority of real-time deepfake attacks.

Tier 2: Enhanced Measure—Safe-Word Verification and Process Filtering

Dynamic Safe-Word Verification:Establish a "verification safe word" with family and core colleagues, and rotate it regularly. When an unusual request is made during a video call, require the other party to state the safe word first. Even if attackers have cloned face and voice, they cannot magically know a privately agreed passphrase.

Organizational Process Filtering:Mandate that all large transfers be submitted through the ERP system with dual approval; never execute solely on a video instruction. This measure blocks non-standard pathways at the institutional level, is independent of AI technology, and therefore immune to deepfake evolution—its reliability is second only to OOB channels.

Tier 3: Auxiliary Measure—Dynamic Gestures and Technical Detection

Dynamic Gesture Verification:Require the other party to perform specific actions (e.g., turn head, blink three times, touch left ear). Current real-time deepfakes struggle to flawlessly render large, unanticipated facial movements. However, beware that social platforms now host numerous "interactive verification games" asking users to perform gestures; these videos may be captured and sold underground to train stronger forgery models. Therefore, dynamic verification should employrandom, non-public, one-timegesture combinations and be rotated regularly. It should also be noted that as 3D animatable head technology advances, the effective window for gesture verification may be limited, so it should not be treated as a long-term core defense.

Technical Detection Tools:Some video-authenticity detection tools are commercially available, analyzing inter-frame consistency, light-source direction, and other features in real time to output a risk probability.Explicit limitation:Deepfake generation technology is iterating faster than individual detection tools can update; attackers can bypass detection through adversarial training or parameter tweaking. Such tools should serve only as pop-up alerts, never replacing human verification or process controls.

Space constraints limit this article to a framework-level overview. Specific implementation details, enterprise deployment case studies, and advanced strategies against emerging attacks will be analyzed in depth in subsequent reports.

4.3 Practical Recommendations for Organizations and Individuals

For enterprises,the most pragmatic step is not to wait for detection technology to mature, but to embed hard thresholds in financial workflows: any transfer instruction above a set amount must be verified via an out-of-band channel (e.g., a separately pre-registered phone number) by calling the purported sender back. Simultaneously, agree on a dynamic verification safe word with executives and finance staff, and rotate it regularly. These two actions cost nearly nothing yet block the vast majority of real-time deepfake attacks.

For ordinary families and individuals,establishing similar verification rules with family members (especially elderly and children) is equally critical. When receiving an "urgent video call for help" from a "relative," hang up first, then call back via a separate contact method (e.g., landline, alternate messaging account), or ask a question only the real person would know. Never lower your guard simply because you see the other party's face on screen.

Cross-platform anti-fraud pop-up integration and similar schemes involve data interoperability and regulatory authorization far beyond the scope of this article, and are therefore not presented as core recommendations here.

4.4 The Real Limitations of Technical Detection

Deepfake generation technology is evolving faster than individual detection tools can be updated; attackers can bypass detection through adversarial training or parameter modification. Under currently available public data, the accuracy of standalone technical detection against high-quality real-time deepfakes remains unreliable. Multimodal detection based on hardware roots of trust can offer higher reliability under specific conditions, but its trajectory requires continued monitoring. Therefore, no single detection method should serve as a standalone defense; it should function only as an auxiliary prompt, combined with process blocking and human verification. The safest defense remains the most elementary:do not accept financial instructions from any single communication channel.

V. From Silence to Transparency: A Path Toward AI Fraud Case Sharing

The attack model reconstructed above makes it clear that AI video call fraud is transforming from a high-bar technical crime into a low-cost, scaled black-market industry. Yet the true defense dilemma lies not in the technology itself, but in the collective silence around case details—companies choose private settlement to avoid reputational damage, law enforcement is bound by investigative confidentiality, and media lack sources for in-depth reporting. This tripartite silence forms a cold deadlock:fewer cases publicized → weaker awareness → thinner defenses → more victims.

This dilemma is not unique to any single region. Internationally, the FBI IC3's anonymous complaint mechanism provides a reference: any victim can submit case information online, which IC3 anonymizes and aggregates into annual reports. The 2025 report included a standalone AI fraud chapter for the first time, disclosing structured data on over 22,000 complaints and USD 893 million in losses. This longitudinal trend analysis and standardized tactic taxonomy has become a vital piece of open-source intelligence for global security research.

Domestically, China's anti-fraud data infrastructure has advanced significantly. The National Anti-Fraud Center app has accumulated over 31.72 million public tip submissions and issued 420 million alerts; the National Data Bureau has established a police-bank-Internet-telecom multimillion-sample high-precision fraud database with 99% fraud-detection accuracy. These foundations provide a solid base for case analysis. However,expert-level deep-dive case analysis and cross-border benchmarkingin the AI deepfake domain still have room for improvement—the value of IC3 reports lies not in volume, but in their structured, researcher-accessible deepfake case repositories and long-term traceable trend baselines. China's massive data reserves currently serve internal regulation and real-time alerting; if appropriately de-sensitized data could be opened to the research community in a limited manner, or if industry standards for tactic taxonomy are established, this data-scale advantage could be converted into a globally leading AI fraud defense knowledge graph.

Of course, case sharing involves privacy protection, commercial secrets, investigative confidentiality, and multiple legal boundaries. Balancing security and transparency requires collaborative exploration. Perhaps the first step can be extremely limited de-sensitized case exchanges, or industry associations leading the formulation of anonymization standards. Regardless, breaking the silence and building trust is an unavoidable challenge in confronting this systemic threat. Only by moving anonymized real cases out of filing cabinets and into an industry-shared knowledge graph can defense evolve from passive reaction to proactive adaptation.

VI. Conclusion

The alerts that make headlines, together with countless undisclosed cases, send a clear signal: in an era where AI deepfake technology has been democratized, the maxim "seeing is believing" is losing its validity. The familiar face and warm voice in a video call can be replicated at minimal cost.

From 2024 to 2026, the cost curve of generation technology has consistently outpaced detection. "Detection" cannot catch "generation," so defense must pivot decisively: stop trying to distinguish real from fake, and instead assume all remote instructions may be fake, mandating secondary verification through an independent channel. Every enterprise can write "video instructions must be verified by callback" into financial policy; every family can agree on a simple verification rule. These measures cost nothing, deliver immediate results, and depend on no immature technology. In the age of deepfakes, those who adopt "distrust" as a default posture will be better positioned to defend.

Insight Report Source: Global Cybersecurity Alliancehttps://www.gcsa.org

References

^[1]: Pan'an County People's Government (浙江省磐安县人民政府),2026 Latest Real-Case Telecom Fraud Exposé[in Chinese], published 2026/04/20. Link:https://www.panan.gov.cn/zwgk/zwzt/xypa/ljxy/xyfxts/art/2026/art_a4c29778f8264f82a9452d5ac8dbdd0c.html^[2]: U.S. Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3),2025 Internet Crime Report, distinguishing AI-related statistics from overall cybercrime metrics. Link:https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf^[3]: Note: The FBI's total annual cybercrime losses approached USD 21 billion across all categories; the AI portion cited here is a separate statistical breakout.^[4]: INTERPOL official press release,INTERPOL report warns of increasingly sophisticated global financial fraud threat, March 2026. Link:https://www.interpol.int/en/News-and-Events/News/2026/INTERPOL-report-warns-of-increasingly-sophisticated-global-financial-fraud-threat^[5]:Ta Kung Pao/tkww.hk, "Hung Hom Raid Smashes 'KK Park' AI Male-Disguised-as-Female Scam Netting HKD 360 Million," October 2024. Link:https://www.tkww.hk/a/202410/15/AP670db563e4b0519806af4af2.html^[6]: Shanxi Consumer Association,Shanxi Consumer Council Issues Warning: Beware of AI Face-Swapping and Voice-Cloning Fraud(2025-12-12), citing police data from multiple jurisdictions. Link:https://www.shanxi315.org.cn/index/index/detail?id=1972^[7]: As of May 2026, no publicly disclosed attack cases have confirmed the actual occurrence of this type of "full-environment compromise" AI-autonomous fraud. This section represents a logical projection based on agentic AI technology and current attack patterns, intended as early warning of potential directions rather than a declaration of confirmed threat.^[8]: The Hacker News,North Korea-Linked Hackers Steal $2.02 Billion in 2025, December 2025. Link:https://thehackernews.com/2025/12/north-korea-linked-hackers-steal-202.html