Your Webcam Is Watching. But Is Someone Else?

A friend of mine — smart, careful, not the type to click sketchy links — noticed something odd one afternoon. The little green light next to her laptop camera flickered on while she was just reading a document. No video call. No browser open. Just her, a spreadsheet, and a light that had no business being on.

She assumed it was a glitch. It wasn't.

The Light Isn't the Whole Story

Most people think the indicator light is the definitive sign. If it's off, you're safe. This is wrong, and it's the most dangerous assumption you can make.

Some malware — particularly older RATs (Remote Access Trojans) — can disable the indicator light independently of the camera itself. According to Johns Hopkins researchers, this was demonstrated on MacBook cameras as far back as 2014, where firmware could be rewritten to activate the camera without triggering the LED. The hardware hasn't fundamentally changed in ways that eliminate this risk.

So if you're using the light as your only check, you're trusting a warning system that can be switched off by the same person trying to hide from you.

What Actually Happens When Someone Gets In

Webcam hacking isn't usually a dramatic heist. It's quiet and patient.

The most common path is a RAT installed through a phishing email, a fake software update, or a cracked app download. Once it's running, the attacker typically has access to far more than your camera — your files, your keystrokes, your microphone. The webcam is often just one tool in a larger surveillance setup.

The second path is less understood: misconfigured or compromised smart home cameras and baby monitors. These aren't your laptop — they're internet-connected devices that often ship with default passwords nobody changes. According to the FBI's Internet Crime Complaint Center, compromised IoT cameras are a consistent and growing vector for home surveillance intrusions.

Signs That Deserve Your Attention

Forget the generic list of "watch for unusual activity." Here's what actually matters:

The light flickers when nothing should be running. Open your Task Manager (Windows) or Activity Monitor (Mac). Look for processes you don't recognize consuming CPU or network bandwidth. A camera application running silently in the background will show up here.

Your storage is being eaten. Some RATs record footage locally before uploading. If your hard drive is filling faster than your usage explains, that's a flag — especially if temporary folders contain video files you never created.

Network traffic spikes at odd hours. You can check this with a free tool like GlassWire on Windows or Little Snitch on Mac. If data is being sent out at 3am when your computer should be idle, something is running that you didn't authorize.

Your antivirus was quietly disabled. This is the one most people miss. Before hijacking your camera, sophisticated malware will often kill your security software first. If you open your antivirus and it's off — and you didn't turn it off — treat that as a serious incident, not an error.

The Counterintuitive Part Nobody Tells You

Here's what most "webcam safety" articles won't say: physical tape works better than almost any software solution.

This sounds absurd, almost embarrassingly low-tech. But it's what security researchers actually use on their own machines. A small piece of electrical tape or a purpose-made webcam cover costs under two dollars and cannot be bypassed by any firmware exploit, any malware, or any zero-day vulnerability. It is, technically, unbreakable protection against visual surveillance.

Software-based camera controls can be circumvented. Physical obstruction cannot. Mark Zuckerberg famously had tape over his laptop camera in a 2016 photo — and that wasn't paranoia theater, it was correct operational security.

The software version of this — disabling the camera in Device Manager — is better than nothing, but a sufficiently privileged piece of malware can re-enable it without your knowledge.

What To Do Right Now

If you're uncertain whether your webcam is clean, start here:

Audit your running processes. On Windows, open Task Manager and look at the Processes tab. Search anything unfamiliar before you dismiss it. On Mac, use Activity Monitor and sort by CPU usage.
Run a dedicated malware scanner. Your regular antivirus may have already been compromised. Download Malwarebytes (the free version works for this) and run a full scan from a separate, trusted machine if possible.
Check camera permissions. On Windows, go to Settings → Privacy → Camera and see which apps have access. On Mac, go to System Settings → Privacy & Security → Camera. Revoke access for anything you don't actively use.
Change every password on a separate device. If you suspect an active compromise, do not change passwords on the infected machine — the keylogger will capture them as you type.
Cover it physically. Do this now, before you finish reading. A Post-it note works. You can buy a proper slider cover for a few dollars online. According to CISA (Cybersecurity and Infrastructure Security Agency), physical controls are among the most reliable mitigations for device-level surveillance risks.

The Part I Won't Pretend Away

Here's the honest limitation: if a sophisticated attacker — state-sponsored, well-resourced, specifically targeting you — has decided to compromise your system, most of what's in this article won't fully protect you. Advanced persistent threats operate at a level where they can hide from standard scanners, exploit unknown vulnerabilities, and persist through factory resets by embedding in firmware.

For the vast majority of people, this isn't the threat model. The realistic danger is commodity malware, opportunistic attackers, and misconfigured devices — all of which the steps above address effectively.

But if you're a journalist, activist, lawyer handling sensitive cases, or someone who has reason to believe a powerful entity is interested in you specifically, consumer-grade advice has real ceilings. At that point, you need dedicated threat modeling, not a checklist.

The tape still helps though. Even for them.

Sources:

Johns Hopkins University – iSeeYou: Disabling the MacBook Webcam Indicator LED
FBI Internet Crime Complaint Center (IC3) – Public Awareness
CISA – Securing Network Infrastructure Devices