Fake Zoom Meeting Installs Spyware Silently
▼ Summary
– A convincing fake Zoom meeting webpage downloads surveillance software onto Windows computers, tricking nearly 1,500 victims in 12 days.
– The page mimics a Zoom waiting room with fake participants and deliberately poor audio/video to prompt users to accept a fake “Update Available” prompt.
– This triggers an automatic download of a malicious installer for Teramind, a legitimate but powerful employee monitoring software.
– The software installs covertly, is invisible to the user, and reports to an attacker-controlled account, enabling activities like keystroke logging and screenshot capture.
– Traditional antivirus tools currently do not detect this threat, and affected users should report to IT or manually search for and remove the software.
Cybersecurity experts have identified a sophisticated online scam that uses a counterfeit Zoom meeting page to secretly install powerful surveillance software on Windows computers. This deceptive site has already impacted a significant number of users, demonstrating the effectiveness of its carefully crafted social engineering tactics.
The scheme begins when a target receives a link, typically via email or text message, inviting them to a Zoom meeting. Clicking the link directs them to a fraudulent webpage designed to perfectly mimic a Zoom waiting room. To enhance the illusion, the page simulates a live meeting. Three fake participants appear to join the call sequentially, with looped conversation audio playing in the background. A persistent ‘Network Issue’ warning is displayed over the main video feed, and the audio and video are intentionally made to appear choppy and lagging.
This deliberate degradation of the user experience serves a critical psychological function. A person experiencing a broken video call will naturally assume there is a problem with the application itself. This sets the stage for the next phase of the attack. An ‘Update Available’ prompt soon appears on the screen, which the user cannot close. A countdown timer ticks from five to zero, creating a sense of urgency.
When the timer finishes, the page seamlessly transitions to a fake Microsoft Store interface, showing “Zoom Workplace” in the middle of an installation. Simultaneously, the web browser automatically downloads a Windows installer file without requesting any user permission. The downloaded file, which uses a name meant to appear legitimate, is actually an installer for Teramind. Teramind is a legitimate commercial software used by businesses for employee monitoring and activity tracking. In this malicious context, it is weaponized for surveillance.
The capabilities of this software are extensive. Once deployed, it can capture screenshots, record every keystroke, access clipboard contents, and monitor a wide range of user activities. The installation process is configured to be completely covert. The installer is pre-set to connect to an account controlled by the attacker and runs without displaying any visible installation windows or progress indicators to the victim.
After installation, the software hides its presence exceptionally well. It does not appear in the list of installed programs, leaves no icon in the taskbar, and creates no entry in the system tray. The attackers also programmed the installer to clean up after itself, deleting all temporary files and folders once the monitoring agent is successfully running. This meticulous approach helps the software evade detection and analysis.
A key aspect of this threat is its use of legitimate tools for malicious purposes. The attackers did not create custom malware; they repurposed a professionally developed commercial product. This makes the surveillance agent more stable and persistent than many traditional malware strains, and it is less likely to be flagged by conventional antivirus programs. Current scans on platforms like VirusTotal show that this specific installer is not detected as malicious by any security vendors.
For individuals who believe they may have been affected, the recommended actions differ based on their situation. Employees who visited the fake page and ran the installer should immediately report the incident to their organization’s IT or security team. Consumers who fell victim should assume their device is compromised. They should search for the tell-tale installation folder, often found at a specific path in the ProgramData directory, and look for hidden running services. Crucially, all passwords for important accounts should be changed immediately from a separate, clean device.
(Source: HelpNet Security)
