phishing-campaign-intelligenceidentity-impersonation-fraudremote-access-implantcredential-stealer-activity

Phishing Campaigns Abuse Legitimate Monitoring and Remote-Access Tools for Stealthy Takeover

Social Engineering & Fraud · 4 sources · Updated 4mo ago · First seen Mar 2, 2026

Security researchers reported multiple phishing campaigns that impersonate trusted brands to trick users into installing legitimate enterprise software repurposed for surveillance and remote control. One campaign uses fake Zoom and Google Meet “meeting room” pages that simulate a waiting room experience (participant names, audio cues, and a persistent “network issue” message) and then pressure victims with a forced “update required” download via a countdown timer. After execution, a modified Teramind agent is installed in stealth mode (no visible icons/notifications), enabling extensive monitoring such as keystroke capture, screenshots, browsing history, and clipboard collection.

A separate campaign targets cryptocurrency users by impersonating the Yoroi Desktop Wallet and advertising a “security upgrade” via a polished landing page hosted on a recently registered domain (hxxps://download[.]v1desktop-yoroiwallet[.]com/). The download chain redirects to a file-sharing service and delivers an MSI (YoroiDesktop-installer.msi) that does not install a wallet; instead it installs GoTo Resolve (LogMeIn) in unattended mode for silent remote access. Reported artifacts include YoroiDesktop-installer.msi (hash 8634AD3C6488D6A27719C5341E91EEB9) and unattended-updater.exe (hash 2A2D9B03AA6185F434568F5F4C42BF49), along with configuration values indicating enrollment into a preconfigured remote-access fleet (e.g., CompanyId: 5504330483880245799, FleetTemplateName: syn-prd-ava-unattended).

Is your org in this campaign?Get the infrastructure and lures behind it.

Hunt this campaign

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Mar 1, 2026 – Mar 20, 2026

Mar 20, 20267mo ago
Sublime reports fake interactive Zoom call delivering ScreenConnect
Sublime disclosed a Zoom-themed phishing campaign in which victims received fake meeting invitations and were led through a realistic spoofed Zoom experience ending in a bogus update download. The MSI installer deployed a legitimate ScreenConnect instance configured for attacker access, providing remote control of the victim device.
Mar 2, 20268mo ago
Researchers document Zoom and Google Meet phishing using Teramind
Security researchers reported a phishing campaign impersonating Zoom and Google Meet meeting pages on Windows systems. The fake meeting sites pushed a modified Teramind monitoring agent disguised as a required update, enabling stealthy surveillance through attacker-controlled infrastructure.
Mar 1, 20268mo ago
Yoroi wallet phishing campaign deploys GoTo Resolve and ScreenConnect
Attackers launched a phishing campaign impersonating the Yoroi Desktop Wallet and directing victims to lookalike domains offering a fake wallet "upgrade." The downloaded MSI installers instead deployed legitimate remote management tools, including GoTo Resolve in unattended mode and a ScreenConnect-based payload, to give attackers persistent remote access.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Affected products

2 linked

ZoomGoogle Meet

Organizations

3 linked

Zoom CommunicationsTeramindYoroi

Observables

16 linked

Domain••••••.comMD5 hash••••••••••••••••••••••••••••••••URLhttps://•••••••.•••/••••••Domain•••••••••.netMD5 hash••••••••••••••••••••••••••••••••URLhttps://••••••••••.•••/•••••Domain••••••••••••.comMD5 hash••••••••••••••••••••••••••••••••+8

Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.

Hunt This Campaign

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

HackreadNews · Mar 20, 2026

New Fake Zoom Meeting Invite Scam Spreads Malware on Windows PCsOpen source ↗

ScworldNews · Mar 20, 2026

Fake interactive Zoom call leads to malicious ScreenConnect download | news | SC MediaOpen source ↗

HackreadNews · Mar 2, 2026

Phishing Pages for Zoom and Google Meet Install Teramind Monitoring ToolOpen source ↗

Malwr Analysis BlogNews · Mar 1, 2026

Yoroi Wallet Phishing Abuses GoTo Resolve and ScreenConnect for Device Takeover - Malware Analysis, Phishing, and Email ScamsOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Phishing Campaigns Abuse Legitimate Monitoring and Remote-Access Tools for Stealthy Takeover

How this story unfolded

Sublime reports fake interactive Zoom call delivering ScreenConnect

Researchers document Zoom and Google Meet phishing using Teramind

Yoroi wallet phishing campaign deploys GoTo Resolve and ScreenConnect

Related entities

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Phishing and software impersonation campaigns delivering malware via trusted services

Phishing Campaigns Weaponize Legitimate RMM Tools for Remote Access and Credential Theft

Phishing Campaigns Delivering Malware via Disguised, Signed Installers and Malicious Attachments

Phishing Campaigns Abuse Legitimate Monitoring and Remote-Access Tools for Stealthy Takeover

How this story unfolded

Sublime reports fake interactive Zoom call delivering ScreenConnect

Researchers document Zoom and Google Meet phishing using Teramind

Yoroi wallet phishing campaign deploys GoTo Resolve and ScreenConnect

Related entities

Affected products

Organizations

Observables

Sources

See the full picture, correlated to your attack surface.

Related stories

Phishing and software impersonation campaigns delivering malware via trusted services

Phishing Campaigns Weaponize Legitimate RMM Tools for Remote Access and Credential Theft

Phishing Campaigns Delivering Malware via Disguised, Signed Installers and Malicious Attachments