Fake Zoom Downloader is the Latest Method of Attack on Remote Workers
Riding on the coattails of the massive rise in popularity in the video conference solution, remote workers new to Zoom need to be wary of where they download the installer.
We’ve written before about the various types of Zoom-related attacks that have sprouted up over the last two months. The latest chapter in this saga involves an actual Zoom installer laden with backdoor malware. Available on malicious third-party sites (and not from Zoom’s official website), these installers are offered up using phishing emails and spam campaigns designed to direct potential victims to these alternative installers.
The compromised installer does deliver an installation of Zoom, but also installs the remote access trojan (RAT) WebMonitor, giving attackers remote access to an infected endpoint via a web browser.
This kind of attack isn’t new, but the rise in necessity and popularity of video conferencing solutions makes Zoom the perfect brand to leverage.
To avoid becoming a victim, the simple answer here is to train users to do two things:
- Don’t act on unsolicited emails about software updates, even if they seem pertinent.
- Only download software from the official website, if at all.
Users undergoing Security Awareness Training already understand the importance of these two simple best practices. But with so many other types of attacks that seek to trick users into participating, it’s important for users to be continually educated to ensure they don’t make these small understandable mistakes with huge ramifications.
SOURCE: KnowBe4
