Researchers discovered a phishing campaign using a fake Zoom meeting page to trick users into silently installing commercial surveillance software.

How the Attack Works

• The Lure: Victims land on a malicious URL (e.g., uswebzoomus[.]com) that mimics a Zoom waiting room, complete with fake participant audio.
• The Trap: A “Network Issue” warning appears, followed by a forced “Update Available” popup designed to “fix” the connection.
• The Distraction: After the download starts, the page redirects to a fake Microsoft Store interface showing a progress bar to mask the background installation.

The Payload: Teramind

The attack deploys a covert version of Teramind, a legitimate employee monitoring tool, instead of traditional malware.

• Capabilities: It captures keystrokes, screenshots, and clipboard data.
• Stealth: The “hidden” configuration ensures no icons appear in the taskbar or system tray, making it invisible to the average user.
• Detection: Because the software is a signed, legitimate tool, it often bypasses standard antivirus flags.

How to Check and Protect Yourself

• Verify Service: Open Command Prompt as admin and run sc query tsvchst. If the status is RUNNING, the agent is active.
• Check Files: Look for a folder named {4CEC2908-5CE4-48F0-A717-8FC833D8017A} inside the hidden C:\ProgramData directory.
• Official Sources: Only download updates via the Zoom Download Center or the app’s internal “Check for Updates” feature.