Fake Zoom Meeting Phishing Campaign Installs Employee Surveillance Spyware

Summary

On February 24, 2026, security researchers reported an active phishing campaign where attackers impersonate a Zoom meeting to trick employees into installing surveillance software on their computers.

Instead of a traditional malware download, victims are redirected to a realistic fake Zoom meeting page. During the call, a fake “Update Available” prompt appears and silently downloads a malicious installer onto the system.

The installed software is a covert version of a legitimate employee-monitoring tool, allowing attackers to spy on compromised machines.

Research Source

According to Malwarebytes research reported by CSO Online, employees who click the meeting invite are taken to a fake Zoom waiting room that simulates participants joining a call. Moments later, a countdown triggers a download without explicit permission.

The attack abuses user trust in collaboration platforms since workers frequently receive meeting invitations from colleagues, customers, and managers.

Technical Details

Attack chain:
1. Phishing email or message sends a Zoom meeting link
2. Victim opens a convincing Zoom-like meeting page
3. A “network issue” appears to make the meeting seem broken
4. Fake update notification appears
5. Browser silently downloads a malicious installer

The attackers deploy a modified build of a legitimate monitoring software rather than custom malware, helping it evade security detection.

Capabilities of the Installed Spyware

Once installed, attackers gain surveillance-level access:
• Keystroke logging
• Screenshot capture
• Website activity tracking
• Clipboard capture
• Email monitoring
• File activity monitoring

The program persists across system restarts and may appear as a normal application.

Observed Attack Behavior

Social Engineering Indicators:
• Unexpected meeting invites
• Urgent subject lines
• Unknown participants
• Requests to install or update software

Victims believe they are fixing a connection issue, making them more likely to click the update prompt.

The entire compromise can occur in under 30 seconds.

Impact

A compromised workstation may allow attackers to:
• Monitor employee activity
• Steal credentials
• Capture confidential documents
• Access corporate email conversations
• Perform internal reconnaissance
• Prepare lateral movement into internal networks

Because this attack targets employees rather than vulnerabilities, it bypasses many traditional security controls.

Mitigation

Recommended defensive actions:

• User Awareness
• Verify Zoom links before joining
• Do not install updates from browser prompts
• Only update Zoom inside the official application

Security teams should treat any system that accessed the fake site as compromised.

Organizations should:
• Hunt for unauthorized remote monitoring tools
• Review endpoint telemetry
• Monitor for abnormal user behavior
• Conduct phishing awareness training

References

• CSO Online – February 24, 2026: Fake Zoom meeting silently installs surveillance software (Malwarebytes research)
• https://www.csoonline.com/article/4136834/fake-zoom-meeting-silently-installs-surveillance-software-says-malwarebytes.html