Threat actors who compromise and take over legitimate email accounts can conduct further malicious activity. For example, they can send fake video teleconferencing (VTC) meeting invitations to impersonate popular platforms, such as Zoom, Google Meet, and Teams. These fraudulent invitations may prompt targets to download and install files or updates to deliver malware. They may also contain links to phishing webpages designed to steal account credentials and sensitive information.
The NJCCIC received a report that threat actors compromised an account and sent fake Zoom meeting invitations with the subject line “Quick Zoom Meeting–Today.” The emails contained a malicious link that, if clicked, directed unsuspecting victims to download a file disguised as Zoom. If downloaded, an unauthorized version of a legitimate remote access tool was installed to control the device remotely, install malware, and steal information. Additionally, an Android spyware dropper was installed to request changes to device permissions and settings, including microphone, camera, location, and screen capture.
Recommendations
- Exercise caution with unexpected or unsolicited communications, including those from known senders or legitimate services or platforms.
- Confirm requests from senders using contact information obtained from verified, official sources before taking action, such as clicking links or opening attachments.
- Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
- Enable multi-factor authentication (MFA) and keep systems and browsers up to date.
- If you suspect your device is infected, disconnect from the internet, run anti-virus/anti-malware scans, and review your security and privacy settings. A full system reimage may be warranted to restore the compromised device.
- If sensitive information was entered, change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources.