Phish of the Week 26th of October

# Phish of the Week

# Phishing

Fake Ongoing Zoom Meeting

Mette Luntama

Fake Ongoing Zoom Meeting Delivers ScreenConnect Remote Access Tool

This campaign impersonates a Zoom meeting invite and leads the recipient to a fake meeting page that looks like a call already in progress. The goal is to get the recipient to install ScreenConnect, a legitimate remote access tool, which gives the attacker full control of the device.

How the attack works:

The recipient receives an email with the subject “Discussion on EFT Settlement Zoom Meeting.” The sender’s display name combines Zoom with the recipient’s own company name, but the actual sender address comes from an unrelated malicious domain.

The email uses Zoom branding and a short message saying a meeting invitation has been shared. A “View Invitation” button points to a shortened t.co link, which hides the real destination until the recipient clicks.

The link opens a fake Zoom join page on a malicious domain. The page shows a host, a meeting ID, an estimated duration, and a green “Host is in the meeting” status. A small design mistake gives it away: the “5 people expected” text is the same color as its white background, so it is invisible unless the recipient highlights it with the cursor. A real Zoom page would not have this kind of styling error.

Clicking “Join now” opens a fake meeting view with blurred participant tiles. Pop-ups and sounds announce that participants are joining the call, so the meeting looks live.

After a few seconds, a prompt appears saying the current Zoom version has expired and a new version is available. Clicking “Download update” downloads ScreenConnect. Once installed, it gives the attacker remote control of the device.

Why the attack works:

The email itself is calm and low-pressure, but the urgency starts as soon as the recipient clicks the link. The join page shows a host already waiting, and the meeting view adds joining participants and familiar call sounds. Suddenly the recipient feels they are late for a call that has already started. That rush, combined with the confusion of landing in a meeting they know little about, pushes them to get in quickly instead of stopping to question it. When the update prompt appears, it looks like the last small step before joining rather than a separate decision.

The payload also helps the attacker avoid detection. ScreenConnect is real software that IT teams use, so security tools may not flag it as malicious. Once it is running, the attacker has access to the whole device, not just a single password.

How to spot similar attacks:

The meeting invite is unexpected and comes from a sender you do not know

The invite link is shortened instead of being a regular zoom.us meeting link

The browser address bar shows a domain that does not belong to Zoom, even though the page looks like a Zoom site

The page asks for a file download or update before the recipient can join

If a meeting invite is unexpected, confirm it with the organizer through a channel you already know, and check with your IT team before installing any software.

What is Phish of the Week?

Phish of the Week is a weekly content initiative by Hoxhunt’s Threat Operations team. Each week, we highlight a current phishing trend or notable real-world attack, covering what the threat is, how it works, and what to watch for to spot similar attacks in the future. The goal is to build consistent recognition of evolving phishing themes and tactics over time.

Comments (0)

Popular