Hackers are widely spoofing Zoom Notifications to steal corporate login credentials via a socially engineered phishing campaign.
Simple. You work for a company; usually, a large one but the size is irrelevant. You are working from home and teleconferences have become the norm.
According to ‘Abnormal Attacks‘ you get an email (spoofed) from your company’s Zoom account saying you have missed an important meeting. It says You can catch the recording here… Click the link.
Hackers get your personal and professional information from dark web profiles on all of us, and it is easy to focus on company employees.
They are getting away with it because anything from your company should be OK. And there is an urgency to access the video that will be deleted in 24 hours.
They use authentic-looking email notices with a Zoom link to authentic-looking landing pages where you must log in with your Microsoft account which is really what the hacker wants.
Of course, Zoom says, “Always double-check the authenticity of each link and that invites come from trusted sources. Avoid logging in from the links provided in emails. Instead, log in directly via the Zoom website.”
But does the average person do that? NO.
Why is this happening to Zoom?
Frankly it grew too soon, too fast to fill a gap for a free/freemium teleconference tool. It was not remotely ready for fame – it had not earned it.
Our recommendation remains
- Google Meet is free and secure for personal and social use
- Microsoft Teams for corporate group meetings and collaboration
- Cisco WebEx for broader audience broadcast meetings
Anything but Zoom (read our in-depth look here)
