MalwarePublished 5 Jun 2025

Be Careful With Fake Zoom Client Downloads

Source AlienVault OTX General

Description

A deceptive email containing a fake Zoom meeting invitation has been identified. Clicking the 'join' button leads to a website prompting users to install a purported Zoom client update. The downloaded executable, 'Session.ClientSetup.exe', is actually malware that installs an MSI package. This package deploys ScreenConnect, a remote access tool, allowing attackers to gain unauthorized access to the victim's computer. The malware establishes persistence by installing itself as a service and connects to a command and control server at tqtw21aa.anondns.net on port 8041. Users are advised to exercise caution when receiving unexpected Zoom invitations or update prompts.

Impact

For European organizations, this threat poses significant risks primarily through unauthorized remote access to corporate endpoints. Successful infection can lead to compromise of sensitive data, intellectual property theft, and disruption of business operations. The use of ScreenConnect as a remote access tool enables attackers to move laterally within corporate networks, escalate privileges, and access critical systems, increasing the risk of widespread compromise. Given the widespread adoption of Zoom across European enterprises—especially in sectors such as finance, healthcare, government, and professional services—the potential for data breaches and operational disruption is considerable. The persistence mechanism complicates detection and remediation, allowing attackers long-term access. Additionally, the phishing vector exploits human factors, making it a persistent threat despite technical controls. Organizations may face regulatory consequences under GDPR if personal or sensitive data is compromised. The threat also raises the risk of follow-on attacks, including ransomware deployment or further malware infections after initial access. Overall, the impact spans confidentiality breaches, integrity violations through unauthorized changes, and availability risks if attackers disrupt systems or services.

Defensive guidance

1. Deploy advanced email filtering solutions with capabilities to detect phishing emails, malicious URLs, and fake meeting invitations, specifically tuned to identify spoofed Zoom invites. 2. Conduct regular, targeted user awareness training emphasizing verification of meeting invitations and caution with unsolicited update prompts, especially those received via email links. 3. Implement application whitelisting to prevent execution of unauthorized software such as 'Session.ClientSetup.exe'. 4. Utilize endpoint detection and response (EDR) tools capable of detecting suspicious service installations, unusual process behaviors, and anomalous network connections, particularly to unknown or suspicious domains like tqtw21aa.anondns.net. 5. Monitor and block network traffic to known malicious domains and IP addresses at the firewall and DNS levels to disrupt command and control communications. 6. Enforce multi-factor authentication (MFA) on remote access tools and critical systems to reduce the impact of compromised credentials. 7. Regularly audit installed services and software on endpoints to detect unauthorized persistence mechanisms and remove malicious services promptly. 8. Maintain comprehensive, tested backups and incident response plans to enable recovery from potential ransomware or destructive attacks following compromise. 9. Encourage users to update Zoom clients only through official application channels or verified internal IT communications, avoiding email-based update prompts. 10. Participate in threat intelligence sharing platforms to stay informed about emerging phishing campaigns, indicators of compromise, and attacker tactics related to this threat.

Indicators of compromise

Domains 1

tqtw21aa.anondns.net

Hashes 1

f5e467939f8367d084154e1fefc87203e26ec711dbfa83217308e4f2be9d58be

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Jul 2025, 16:26 UTC

MITRE ATT&CK techniques6 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 1

Community reviews

Related threats