Loading story…
A malicious campaign is using a convincing fake Zoom “waiting room” at uswebzoomus[.]com/zoom/ to trick Windows users into installing Teramind-based surveillance tooling, with reporting indicating roughly 1,437–1,500 victims in about 12 days. The page is designed to evade basic automated scanning by only triggering its behavior after real user interaction; it then simulates a live meeting by showing three scripted participants joining (e.g., “Matthew Karlsson,” “James Whitmore,” “Sarah Chen”), playing looped conversation audio, and displaying a persistent “Network Issue” banner to create frustration and prime the victim to accept an “update.”
After a short delay, an uncloseable “Update Available” prompt with a countdown forces a download of a Windows installer while the site displays a fake Microsoft Store “Zoom Workplace” installation screen as misdirection. The downloaded MSI (reported as zoom_agent_x64_s-i(__941afee582cc71135202939296679e229dd7cced) (1).msi) installs Teramind configured to report to an attacker-controlled account and to run with minimal/no visible installation cues; Teramind’s capabilities include screenshot capture, keystroke logging, and clipboard capture. Researchers attributed the campaign’s effectiveness primarily to psychological manipulation rather than sophisticated exploitation, and Teramind stated it is not affiliated with the threat actors and did not authorize the malicious deployments.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Teramind stated it was not affiliated with the threat actors and had not authorized use of its employee-monitoring software in the campaign. The statement clarified that attackers were abusing a legitimate commercial tool for covert surveillance.
Researchers disclosed that the MSI used across the Zoom and Google Meet lures was identical and used a .NET custom action to extract a Teramind instance ID from the filename, allowing one binary to support multiple attacker accounts. The analysis also documented a connectivity check to rt.teramind.co, default stealth mode, persistence via two Windows services, and published hashes, domains, and other IoCs.
Following the Zoom-domain suspension, researchers observed the same operation continue through a Google Meet-themed domain and related infrastructure. The new lure delivered the same MSI payload, showing the campaign had expanded beyond Zoom impersonation.
After researchers reported the Zoom-themed domain used in the campaign, Namecheap suspended it. This disrupted the original lure infrastructure but did not end the operation.
Malwarebytes published analysis of the fake Zoom "waiting room" scam, describing how the site simulated a broken meeting and triggered a disguised Zoom Workplace/MSI install. The report noted the installer had little to no antivirus detection at the time and advised victims to treat affected devices as compromised.
Within about 12 days of detection, the fake Zoom campaign reportedly compromised approximately 1,437 to 1,500 users worldwide. The installer deployed Teramind configured to report to attacker-controlled accounts while remaining minimally visible on victim systems.
A social-engineering campaign using a fake Zoom "waiting room" site to deliver a malicious MSI installer was first detected via Microsoft Defender for Endpoint. The operation used a convincing broken-call scenario and forced update prompt to trick Windows users into installing a stealth-configured Teramind agent.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
3 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malwarebytes reported a social-engineering campaign that uses a **fake Zoom meeting** lure to trick victims into installing **surveillance software** without obvious user awareness, highlighting continued abuse of trusted collaboration brands as an initial access vector (CSO Online). The activity fits a broader pattern of user-targeted delivery mechanisms—such as **SEO poisoning/malvertising** that pushes trojanized admin tools (e.g., PuTTY/WinSCP) and known loaders like **Oyster/CleanUpLoader**—to compromise software professionals and business users via seemingly legitimate download paths. Several other items in the set are not about this incident and should be treated as off-topic or low-signal for incident tracking: a policy/politics discussion about US DoD pressure on Anthropic’s *Claude* for military use, a detection-engineering newsletter that includes hiring and a webinar plug, a CSIS roll-up page listing historical “significant cyber incidents,” and a Dark Reading piece focused on **cybersecurity VC/M&A** trends tied to AI. Those sources do not provide corroborating details, IOCs, or technical specifics about the fake-Zoom surveillance campaign itself.
Jun 29, 2026
Security researchers reported multiple phishing campaigns that impersonate trusted brands to trick users into installing **legitimate enterprise software** repurposed for surveillance and remote control. One campaign uses fake **Zoom** and **Google Meet** “meeting room” pages that simulate a waiting room experience (participant names, audio cues, and a persistent “network issue” message) and then pressure victims with a forced “update required” download via a countdown timer. After execution, a **modified Teramind agent** is installed in *stealth mode* (no visible icons/notifications), enabling extensive monitoring such as keystroke capture, screenshots, browsing history, and clipboard collection. A separate campaign targets cryptocurrency users by impersonating the **Yoroi Desktop Wallet** and advertising a “security upgrade” via a polished landing page hosted on a recently registered domain (`hxxps://download[.]v1desktop-yoroiwallet[.]com/`). The download chain redirects to a file-sharing service and delivers an MSI (`YoroiDesktop-installer.msi`) that does not install a wallet; instead it installs **GoTo Resolve (LogMeIn)** in **unattended** mode for silent remote access. Reported artifacts include `YoroiDesktop-installer.msi` (hash `8634AD3C6488D6A27719C5341E91EEB9`) and `unattended-updater.exe` (hash `2A2D9B03AA6185F434568F5F4C42BF49`), along with configuration values indicating enrollment into a preconfigured remote-access fleet (e.g., `CompanyId: 5504330483880245799`, `FleetTemplateName: syn-prd-ava-unattended`).
Jun 29, 2026
Threat actors used fake installers for **Zoom** and **Microsoft Teams** to compromise users seeking collaboration software, often through cloned download pages and malicious ads. In one Zoom campaign, a trojanized `ZoomPortable.exe` established persistence through the Windows Startup folder, unpacked a modified Zoom client into a temporary directory, and later used a patched `zoom.exe` to fetch and run a PowerShell payload that profiled victims, contacted attacker-controlled infrastructure, and accepted reconnaissance and arbitrary execution commands. Investigators observed follow-on activity including shellcode linked to **Cobalt Strike**, while Microsoft separately reported **FakeUpdates** malvertising that redirected victims to fake Teams update sites, installed legitimate software as cover, and delivered malware including **ZLoader**, **Predator the Thief**, **NJRat/Bladabindi**, and Cobalt Strike beacons.
Aug 15, 2026