Abuse of Zoom Docs & Events in Latest Phishing Campaign

Published Date: July 1, 2025

Category: ShadowOpsIntel

A sophisticated phishing campaign is actively exploiting Zoom’s legitimate infrastructure, specifically Zoom Events — to launch both credential harvesting and malware distribution attacks. The phishing emails originate from noreply-zoomevents[@]zoom[.]us, making use of fully authenticated email headers (SPF, DKIM, DMARC), thereby bypassing traditional email security filters. Victims are tricked into accessing a malicious Zoom-hosted link that redirects them to either a fake login portal or downloads a renamed ScreenConnect binary.

Severity Level: High

Threat Overview

Initial Discovery: Recon SOC noticed a spike in phishing emails impersonating Zoom Events invitations.
Technique Used – ChainLink Phishing: A method where users are led through multiple legitimate-looking domains and CAPTCHAs before reaching the final malicious payload or phishing site.
Redirection Chain:
- Initial Link – Zoom Hosted (docs.zoom.us/doc/)
  - Victims receive an email from a legitimate Zoom domain (noreply-zoomevents[@]zoom[.]us) containing a link to hxxps[:]//docs.zoom[.]us/doc/. The emails urge victims to view a document or download a desktop app.
  - This URL is typically associated with Zoom documentation but is being abused to add credibility and bypass URL filters.
- Fake CAPTCHA Verification Page
  - Users are redirected to a CAPTCHA-style page, simulating a security check (e.g., “Verify You’re Not a Robot”).
  - This page is not hosted by Zoom and serves two purposes:
    - Obfuscate the true destination.
    - Add legitimacy and delay automated scanning tools.
- Final Malicious Destination (Branching)
  - Branch A – Credential Theft (AitM):
    - Users are redirected to a Microsoft login phishing page (Adversary-in-the-Middle setup).
    - Page captures both credentials and session cookies (bypassing MFA) by proxying the legitimate Microsoft login in real-time.
  - Branch B – Malware Delivery:
    - Instead of a login form, the victim is served a malicious file download, typically disguised as a Zoom-related app or document.
    - The payload is a renamed variant of ScreenConnect remote access tool (e.g., Zoom_Viewer.exe).
    - Once executed, it provides persistent remote access to the attacker.

Recommendations

Educate users to verify “Zoom Events” invites through known-good channels (e.g., internal calendar vs. email invite) and not to click on links or download files from unexpected “Zoom Events” emails.
Restrict installation of remote access tools (like ScreenConnect) via application allowlisting.
Flag emails from noreply-zoomevents[@]zoom[.]us containing links to docs.zoom[.]us/doc/ combined with urgent CTAs like “View File” or “Download App”
Detect ChainLink Redirection Patterns: docs.zoom[.]us/doc/ → CAPTCHA → login page or file download
Alert on ScreenConnect.exe or renamed variants executed from %Downloads% and Outlook or browser spawning ScreenConnect installer or unrecognized binaries.
Enforce MFA on Microsoft 365 and cloud apps to limit credential abuse from AitM phishing.
Audit for OAuth grants or unusual login activity post-phish-click events.
Block the IOCs at their respective controls:
https://www.virustotal.com/gui/collection/a435fc31ad16fe35fc7f346edfc25fef9c81f1543b299ff3cecb4a418234b5cb/iocs

MITRE ATT&CK

Tactic	Technique	ID	Details
Initial Access	Phishing: Spearphishing Link	T1566.002	Malicious emails sent via legitimate noreply-zoomevents@zoom.us, encouraging users to click links.
Initial Access	Valid Accounts	T1078	Attackers likely used compromised Zoom accounts to send emails from legitimate domains.
Execution	User Execution: Malicious File	T1204.002	Victims are tricked into downloading a renamed ScreenConnect.exe file and executing it.
Execution	User Execution: Malicious Link	T1204.001	Users click on phishing links directing to AitM credential sites via trusted docs.zoom.us.
Credential Access	Adversary-in-the-Middle	T1557.002	AitM phishing page collects Microsoft login credentials.
Command & Control	Remote Access Software	T1219	ScreenConnect used to establish unauthorized remote access.
Defense Evasion	Signed Binary Proxy Execution	T1218	Malicious payload disguised and delivered via signed Zoom infrastructure.
Defense Evasion	Impair Defenses: Email Filter Bypass	T1562.008	SPF/DKIM/DMARC-passed emails bypassed most email protection systems.
Persistence	External Remote Services	T1133	Persistence through ScreenConnect’s remote access capabilities.

Source:

https://blog.reconinfosec.com/zoom-events-phishing

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.