A recently identified phishing campaign is abusing a fake Zoom meeting page to silently deploy surveillance software onto Windows systems. Instead of delivering traditional malware, the attackers leverage a legitimate commercial employee monitoring product “Teramind”, configured in stealth mode and pre-registered to an attacker-controlled server. The campaign relies heavily on social engineering, automated download triggers, and UI deception rather than technical exploitation, making it both effective and difficult to detect with conventional signature-based defenses.
Severity: High
Threat Infrastructure & Delivery
The campaign utilizes a sophisticated social engineering “waiting room” to facilitate the infection.
- Primary URL: uswebzoomus[.]com/zoom/.
- Deception Mechanism:
- Fake Participants: Three scripted bots (“Matthew Karlsson,” “James Whitmore,” and “Sarah Chen”) appear to join the call with authentic audio chimes.
- Simulated Technical Issues: A hardcoded “Network Issue” warning and deliberate audio/video lagging encourage the user to accept an “Update”.
- Visual Mimicry: After the download, the site displays a fake Microsoft Store interface showing “Zoom Workplace” mid-installation to mask the malicious activity.
- The Payload: Ten seconds after the meeting screen appears, a mandatory five-second countdown triggers a silent download of the installer without user permission.
Malware technical profile: teramind “stealth mode”
The attackers have repurposed Teramind, a commercial monitoring product, as a form of “stalkerware”.
- Filename: zoom_agent_x64_s-i(_941afee582cc71135202939296679e229dd7cced) (1).msi
- Persistence: Installs as a system service named tsvchst.
- Stealth: Runs as dwm.exe in C:\ProgramData{GUID}; has no taskbar icon or system tray entry.
- Capabilities: Logs keystrokes, screenshots, clipboard contents, app usage, and email/file activity.
- Evasion: Includes DETECT_DEBUG_ENVIRONMENT logic to change behavior if run in a sandbox.
Analysis & Impact
This campaign is particularly dangerous because it uses legitimate, signed software to bypass traditional antivirus tools that primarily look for known malicious code.
- Targeting: users joining personal or professional meetings.
- Ease of Infection: The transition from click to installation takes less than 30 seconds.
- Attacker Advantage: Using commercial software provides the attackers with professional-grade stability and persistence that custom malware often lacks.
Recommendations
- Always hover over a link to inspect the actual destination URL; if it is not zoom[.]us, do not click it.
- Launch meetings directly through the installed Zoom application rather than following browser-based redirects from unexpected emails or messages.
- Be wary of any “update” that triggers automatically with a countdown and provides no option to cancel or close the window.
- Use tools like AppLocker or Windows Defender Application Control (WDAC) to prevent unauthorized .msi files from executing in user directories.
- Configure EDR tools to alert on any new executables (specifically dwm.exe) being created within the C:\ProgramData{GUID} directory path.
- Create a detection rule for the creation of a new system service named tsvchst, which is the primary persistence mechanism for this stealth agent.
- If Compromise is Suspected:
- Verify Infection: Open Command Prompt as admin and run sc query tsvchst; a RUNNING state confirms the presence of the agent.
- Identify Files: Enable “Hidden items” in File Explorer and check C:\ProgramData for the {4CEC2908-5CE4-48F0-A717-8FC833D8017A} folder.
- Change passwords for all sensitive accounts (banking, email, corporate) using a separate, known-clean device.
- If the machine is company-owned, immediately disconnect from the network and report to the IT or security team.
- Block the IOCs at their respective controls
https://www.virustotal.com/gui/collection/86b192ed851b9c3354a4e890322a031b9b7638e65f4de62ce13fe0071429c46e/iocs
Source:
- https://www.malwarebytes.com/blog/scams/2026/02/fake-zoom-meeting-update-silently-installs-surveillance-software
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.