Fake Zoom and Google Meet Pages Trick Users Into Installing Monitoring Tool

Fake Zoom and Google Meet pages trick users into installing a monitoring software on Windows systems through phishing links and fake updates.

Security researchers have documented an active phishing campaign that uses convincing clones of Zoom and Google Meet waiting rooms to trick users into installing remote monitoring software on Windows systems.

While many phishing attacks use custom-built malware, this campaign utilizes a legitimate, commercially available employee monitoring tool. In this instance, the tool is being repurposed by unauthorized third parties to spy on victims who believe they are simply joining a professional video call or installing a required update.

The Mechanism of the Attack

The scam typically begins with a phishing link disguised as a meeting invitation. Upon clicking, the user is directed to a page that mimics a Zoom waiting room, complete with audio cues of other participants joining to create a sense of legitimacy.

The page simulates ...