Zoom Phishing Steals Login Credentials

A new phishing campaign is tricking users with fake Zoom meeting invites that appear to come from coworkers.

The scam uses familiar work-related messaging to steal login credentials.

Researchers warn that the fake meeting page looks convincing, even showing a video of fake “participants” to make it seem real.

The urgent tone in the email pushes users to click links quickly, increasing the risk of falling for the scam.

Sophisticated Phishing Scam Targets Zoom Users

A new phishing scam is fooling users with fake Zoom emails that closely mimic real meeting invites. These emails copy Zoom’s branding and formatting to avoid suspicion.

When users click the link, they’re taken to a fake meeting page that asks for their Zoom login or other sensitive info. The fake sites use domain names that look almost identical to real ones.

Experts say stolen credentials can lead to wider network breaches, as attackers may use them to access company systems.

The phishing emails use personalized links, hinting that attackers may have prior data on targets—making the scam more believable. This approach shows a higher level of planning than usual phishing attacks.

The scam also plays on urgency and fear of missing important meetings, making users more likely to click without thinking.

To stay safe, users should avoid clicking suspicious links and verify unexpected invites directly with coworkers. Companies should use strong email filters, train staff on phishing awareness, and enable multi-factor authentication (MFA) to protect against stolen passwords.

Indicators of Compromise (IoCs)

Type	Indicator
URL	hxxps://tracking[.]cirrusinsight[.]com/e39ee0e9-c6e2-4294-8151-db8d9e454e24/one-ebext-in-openurl#targetid=john[.]doe@company[.]com&uname=john[.]doe&4030483277383-2874893
URL	hxxps://pub-51656ae3d0ef4f2ba59cdfc6830c8098[.]r2[.]dev/meeting[.]htm?utm_campaign=8634688-zm-30000&utm_source=ppc#targetid=john[.]doe@company[.]com&uname=john[.]doe&4030483277383-2874893
POST Endpoint	hxxps://api[.]telegram[.]org/bot7643846141:AAH3xkttszS0hQgqj7PaS_f7XetLz-_DTQc/sendMessage