Loading story…
Threat actors used fake installers for Zoom and Microsoft Teams to compromise users seeking collaboration software, often through cloned download pages and malicious ads. In one Zoom campaign, a trojanized ZoomPortable.exe established persistence through the Windows Startup folder, unpacked a modified Zoom client into a temporary directory, and later used a patched zoom.exe to fetch and run a PowerShell payload that profiled victims, contacted attacker-controlled infrastructure, and accepted reconnaissance and arbitrary execution commands. Investigators observed follow-on activity including shellcode linked to Cobalt Strike, while Microsoft separately reported FakeUpdates malvertising that redirected victims to fake Teams update sites, installed legitimate software as cover, and delivered malware including ZLoader, Predator the Thief, NJRat/Bladabindi, and Cobalt Strike beacons.
Get the infrastructure and lures behind it.
11 events from the most recent confirmed update back to the earliest known activity.
Microsoft Defender for Endpoint alerted on suspicious PowerShell execution initiated by a Zoom process on a customer workstation on April 7, 2021. Investigation showed the Zoom instance was running from a temp-directory installation created by a malicious self-extracting file named ZoomPortable.exe.
In May, researchers found malware samples masquerading as Zoom installers, including Trojan.Win32.ZAPIZ.A and Backdoor.Win32.DEVILSHADOW.THEAABO. These fake installers also deployed a legitimate Zoom client to reduce user suspicion.
In April, researchers discovered attacks that bundled a legitimate Zoom installer with the RevCode WebMonitor RAT, identified as Backdoor.Win32.REVCODE.THDBABO. The malware provided remote command execution, file manipulation, keystroke logging, and information-gathering capabilities.
Talos reported that attackers used Discord CDN links in 2020 malspam campaigns to distribute malicious archives and payloads, including Formbook and Nymaim. The lures commonly impersonated invoices, shipping documents, and other business communications.
Microsoft reported that in 2020 the FakeUpdates malvertising campaigns were dropping WastedLocker ransomware. The campaigns used fake software update lures and continued evolving their payloads and delivery methods.
Microsoft said the FakeUpdates malvertising campaigns had previously been observed in 2019 delivering DoppelPaymer ransomware. This established an earlier lineage for the later fake software update and collaboration-app lures.
Analysis showed the fake Zoom installer persisted via the Startup folder, unpacked a modified Zoom client into the temp directory, and used a patched zoom.exe to download and execute b.ps1 after a delay of two to seven days. The PowerShell payload profiled victims, accepted reconnaissance and arbitrary execution commands, and in at least one case fetched shellcode that Microsoft Defender detected as Cobalt Strike.
Investigators determined the malicious ZoomPortable.exe was downloaded via Chrome from veehy[.]com, a cloned Zoom download site, after the victim followed a path consistent with a Google advertisement click through linkx[.]ind[.]br. The user later confirmed the delivery vector was a Google ad for Zoom.
Cisco Talos published analysis showing threat actors increasingly used Discord and Slack for malware hosting, second-stage retrieval, command-and-control, and data exfiltration. The report documented multiple malware families and webhook-based exfiltration techniques abusing legitimate collaboration infrastructure.
Trend Micro described cybercriminal campaigns abusing popular communication platforms, including fake Zoom installers, Slack webhook reporting by Crypren ransomware, and Discord-hosted malware delivery leading to AveMaria or AgentTesla infections. The report highlighted how attackers blended malicious activity with trusted collaboration services.
Microsoft warned customers about FakeUpdates campaigns that used malicious ads and poisoned search results for Microsoft Teams to redirect victims to attacker-controlled domains. The infections installed legitimate Teams software as cover while delivering malware such as Predator the Thief, ZLoader, NJRat, and Cobalt Strike, with some attacks ending in ransomware deployment.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
8 references tracked. Mallory keeps watching after this page renders.
blog.trendmicro.com
Open sourceinde.nz
Open sourceblog.talosintelligence.com
Open sourcetrendmicro.com
Open sourcebleepingcomputer.com
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourcemalpedia.caad.fkie.fraunhofer.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malwarebytes reported a social-engineering campaign that uses a **fake Zoom meeting** lure to trick victims into installing **surveillance software** without obvious user awareness, highlighting continued abuse of trusted collaboration brands as an initial access vector (CSO Online). The activity fits a broader pattern of user-targeted delivery mechanisms—such as **SEO poisoning/malvertising** that pushes trojanized admin tools (e.g., PuTTY/WinSCP) and known loaders like **Oyster/CleanUpLoader**—to compromise software professionals and business users via seemingly legitimate download paths. Several other items in the set are not about this incident and should be treated as off-topic or low-signal for incident tracking: a policy/politics discussion about US DoD pressure on Anthropic’s *Claude* for military use, a detection-engineering newsletter that includes hiring and a webinar plug, a CSIS roll-up page listing historical “significant cyber incidents,” and a Dark Reading piece focused on **cybersecurity VC/M&A** trends tied to AI. Those sources do not provide corroborating details, IOCs, or technical specifics about the fake-Zoom surveillance campaign itself.
Jun 29, 2026
Microsoft reported ongoing **OAuth abuse** campaigns targeting government and public-sector organizations, where phishing emails lure users into clicking links that leverage legitimate identity-provider redirect behavior (e.g., **Microsoft Entra ID** and other OAuth providers) to send victims to attacker-controlled pages for malware delivery and potential device takeover. Lures included e-signature requests, Teams meeting recordings, Microsoft 365 password resets, and political themes; Microsoft said it disabled identified malicious OAuth applications but warned related activity persists and requires continued monitoring. Separately, researchers described multiple **deception-based malware delivery** operations that rely on impersonation of trusted brands and software rather than exploiting product vulnerabilities. One campaign spoofed **Zoom** and **Google Meet** to install the legitimate *Teramind* monitoring agent for covert surveillance, using fake landing pages and a Microsoft Store lookalike, persistence via services (including `tsvchst` and `pmon`), and traffic masking via built-in SOCKS5 proxy support; defenders were advised to check for related drivers (e.g., `tm_filter.sys`, `tmfsdrv2.sys`) and artifacts under *ProgramData*. Another campaign used a lookalike domain (`filezilla-project[.]live`) to distribute a trojanized portable **FileZilla 3.69.5** bundle that adds a malicious DLL for DLL search-order hijacking, enabling credential theft (including saved FTP credentials) and C2 activity—highlighting a broader trend of **trusted software impersonation** and search/SEO poisoning as an initial access vector.
Jun 29, 2026
Security researchers reported active phishing activity targeting enterprise users by impersonating routine workplace workflows (e.g., meeting invites, invoices, and document notifications) to trick recipients into running malware. One campaign used executables masquerading as *Microsoft Teams*, *Zoom*, and *Adobe Acrobat Reader* installers (e.g., `msteams.exe`, `zoomworkspace.clientsetup.exe`, `adobereader.exe`, `invite.exe`) that appeared trustworthy because they were **digitally signed** with an Extended Validation (EV) certificate issued to **TrustConnect Software PTY LTD**. Microsoft Defender telemetry attributed the activity to an unknown threat actor and assessed the approach as a deliberate, multi-wave effort designed to bypass user suspicion and basic security controls. After execution, the signed malware deployed **remote monitoring and management (RMM)** tooling—reported examples include **ScreenConnect**, **Tactical RMM**, and **Mesh Agent**—to establish persistent remote access and enable follow-on actions across affected environments. Separately, reporting also highlighted phishing lures distributing **malicious ISO attachments** embedded in job application/resumé-themed emails, reinforcing that attackers continue to rely on socially engineered business processes (recruiting and HR workflows in particular) to deliver initial payloads and gain a foothold.
Jun 29, 2026