Security researchers have discovered a new phishing campaign that uses Zoom to invite employees to a supposed conference call, informing them that their contract with their company will be suspended or terminated.
Victims receive a fake link, which leads to a fabricated Zoom website, which asks users to enter login .
As you likely know, Zoom is one of the most popular video conferencing platforms, with additional features such as online meetings, chat, and mobile collaboration.
New Phishing Campaign
More than 50,000 company employees have fallen victim to this new phishing campaign, as discovered by security researchers at Abnormal Security. The campaign primarily targets employees using Office 365.
The email that recipients receive contains the link “zoom-emergency.myftp[.] Org” which leads to a fake website, as well as the domain hidden in an option such as “Join this live meeting.”
Once the victim enters their login credentials, they will be sent to the fake Zoom server controlled by the hackers.
The email acts as a warning that the employee's contract will be terminated, intended to create panic so that the victim is taken by surprise and hurriedly enters their credentials to join the conference call, without paying much attention to the website.
“Users who frequently use Zoom will see the login page, believe their session has expired, and try to log in again. They will be more likely to enter their login credentials without realizing it is a phishing page.”
The incident comes just days after the discovery of a Zoom vulnerability, which allowed hackers to record sessions on the platform, as well as conversations, without the participants knowing, even if the person organizing the video conference disabled the recording option for participants.
Cybercriminals continue to exploit the pandemic to launch malware , phishing, scams , and disinformation campaigns. As more employees are working from home, using platforms like Zoom, attacks on these have increased.
