Fake Zoom Call Lures for Zoom Workplace Credentials

Keypoints

• Threat actors send phishing emails with urgent Zoom-themed messages to create a sense of panic and prompt quick action.
• The phishing email contains a deceptive Zoom meeting hyperlink that uses URL masking and multiple redirects to a fake landing page.
• The fake Zoom meeting page mimics legitimate Zoom visuals and displays a “meeting connection timed out” message before redirecting to a credential harvesting login form.
• The phishing login page pre-fills the user’s email address to increase credibility and lure victims into submitting their passwords.
• Exfiltration of captured credentials, along with IP address and location data, occurs via Telegram’s messaging API, sending data directly to the threat actors.
• This phishing method exploits employee reliance on Zoom credentials, risking lateral movement and potential Advanced Persistent Threats (APTs) inside affected organizations.
• Cofense combines phishing detection, rapid remediation, and real-time security awareness training to combat such sophisticated phishing tactics.