CampaignPublished 24 Feb 2026

Fake Zoom meeting 'update' silently installs surveillance software

Source AlienVault OTX General

Description

A deceptive campaign is using a fake Zoom meeting website to covertly install Teramind, a commercial monitoring tool, on unsuspecting users' Windows machines. The operation begins with a convincing imitation of a Zoom video call, complete with scripted participants and artificial technical issues. An automatic 'Update Available' prompt then initiates the download of a malicious installer without user consent. The installed software is a covert build of Teramind, designed to run invisibly and avoid detection by security tools. This campaign is particularly dangerous due to its use of legitimate commercial software, which may evade traditional antivirus detection. The attackers exploit users' trust in Zoom and Microsoft to execute their plan, highlighting the importance of verifying meeting links and being cautious with unexpected software updates.

Impact

The impact of this threat is significant for organizations globally, especially those relying heavily on Zoom for communication and collaboration. The covert installation of Teramind surveillance software can lead to unauthorized monitoring of employee activities, data exfiltration, and privacy violations. This can result in intellectual property theft, exposure of sensitive business information, and regulatory compliance issues related to employee monitoring and data protection laws. The stealthy nature of the installation increases the risk of prolonged undetected surveillance, enabling attackers or insider threats to gather extensive intelligence. The use of legitimate commercial software complicates detection and response efforts, potentially leading to false negatives in security monitoring. Organizations may face reputational damage, legal liabilities, and operational disruptions if such surveillance is discovered or exploited. The campaign also demonstrates how social engineering can bypass technical controls, emphasizing the human factor as a critical vulnerability. While the campaign currently targets Windows users, the widespread use of Zoom and Teramind in corporate environments means the threat could affect diverse sectors including finance, healthcare, government, and technology worldwide.

Defensive guidance

To mitigate this threat, organizations should implement multi-layered defenses focused on both technical controls and user awareness. First, enforce strict verification of meeting URLs and sources before joining any Zoom meeting, especially those prompting updates or downloads. Educate users to recognize legitimate Zoom update mechanisms and to avoid interacting with unsolicited update prompts during meetings. Deploy endpoint detection and response (EDR) solutions capable of identifying unauthorized installations of Teramind or similar monitoring software, including monitoring for unusual process behaviors and persistence mechanisms. Implement application whitelisting to prevent unauthorized executables from running, particularly those downloaded from untrusted domains like uswebzoomus.com. Network defenses should include blocking access to known malicious domains and hashes associated with this campaign. Regularly audit installed software on endpoints to detect unauthorized monitoring tools. Employ behavioral analytics to detect anomalous user activity or data access patterns indicative of surveillance. Finally, maintain up-to-date security awareness training emphasizing social engineering risks and the importance of verifying software updates through official channels only.

Indicators of compromise

Domains 1

uswebzoomus.com

Hashes 2

941afee582cc71135202939296679e229dd7cced
644ef9f5eea1d6a2bc39a62627ee3c7114a14e7050bafab8a76b9aa8069425fa

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 24 Feb 2026, 20:46 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 2

Community reviews

Related threats