In the digital age, online meetings have become common. However, cybercriminals are now creating fake versions of popular platforms such as Skype, Google Meet, and Zoom, posing a new threat.
A recent campaign discovered by Zcaler's ThreatLabz revealed that threat actors are creating counterfeit online meeting sites to distribute Remote Access Trojans (RATs) to Android and Windows users. These RATs are designed to steal sensitive data, log keystrokes, and steal files.
The attackers host fake meeting sites on shared web hosting services, using URLs that closely mimic legitimate services. For example, the Skype campaign used "join-skype[.]info," while Google Meet users were enticed to join meetings via "online-cloudmeeting[.]pro." The Zoom campaign uses "us06webzoomus[.]pro.
Once a user is lured into these fake meetings, they are prompted to download malicious executables or applications that appear to be legitimate meeting software. These files, however, are RATs in disguise, ready to compromise the user's device. This attack is interesting because it recognizes and adapts to the user's operating system and downloads malicious files in the appropriate format.
To combat this evolving threat, here are a couple of recommendations:
- Stay Vigilant: Always verify the authenticity of meeting links. Look for subtle clues in the URL that may indicate a fake site. If in doubt, go directly to the official website to join a meeting.
- Regular Updates: Ensure all devices and applications have the latest security patches. This reduces the risk of vulnerabilities that attackers can exploit.
By staying informed and cautious, we can protect ourselves from these sophisticated cyberattacks and maintain the integrity of our online interactions.
#ALTACyber
------------------------------
Genady Vishnevetsky
Chief Info Security Officer
Stewart Title Guaranty Company
Houston TX
------------------------------