Beware of fake Zoom apps. Use hacked certificates.

Beware of fake Zoom apps. Use hacked certificates to smuggle malware onto victim machines.

The Zoom application, although not as popular today as during the COVID era, is still an application adopted by many companies in online meetings or job interviews, and as it is still popular among businesses, hackers have taken advantage of this point to release malware.

According to a report by the website, Hackread has mentioned the detection of phishing deception campaigns to release malware on victims of office workers, using fake applications like Zoom and Microsoft Teams (as well as popular document reading applications like Adove Acrobat) as decoys, because the target audience is often a group that has to have meetings with companies or frequent customer appointments. The campaign was detected in February by a research team from Microsoft Defender Security Research Team, a research agency focused on researching Microsoft's cybersecurity methods.

The research team has revealed that the campaign will start with hackers sending phishing emails in the form of meeting links or blurred PDF documents. After pressed, the link or link inside the document will take the website to download the fake application. The website will deceive the victim that the victim is unable to attend the meeting or read the document because the application is too old. Download the update to install it.

And to create trust for installation files like msteams.exe or adobereader.exe, they are "signed" with a Trusted Certificate that has been hacked by hackers. This campaign will use the TrustConnect Software PTY LTD certificate. The certificate is an Extended Validation Certificate, a type of certificate that is very reliable, allowing the above installation files to break through blocks comfortably.

After the file is processed and installed, it will be installed to install Remote Monitoring and Management (RMM) tools, which are usually tools for IT departments based on organizations to help fix problems on the machine for employees in the organization. In this case, these tools are used as system backdoors or backdoors, so that hackers can log in to the victim's company at any time. In addition to ensuring that this attack lasts for a long time. (Persistence) The PowerShell script inside the fake application will quietly run to install a similar tool. Others, such as ScreenConnect and MeshAgent, guarantee that the company's IT administrator will detect and delete one of them, there are still alternatives to access the system.

When a hacker can be embedded in the system through such tools, it leads to other operations, such as password theft or ransom malware release or Ransomware to the system to continue threatening calls from the victim company.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # zoom