Fake Zoom Calls Trick People Into Installing Malware by Pretending Their Audio Is Broken

Fake Zoom and Microsoft Teams meetings are turning apparent audio faults into instructions to download files or run commands that retrieve malware.

Attackers present the actions as troubleshooting, guiding targets through a supposed repair while an apparently legitimate business call is waiting to begin, according to GBHackers' reporting on findings from the Security Alliance.

A founder associated with BitsaveProtocol describes an encounter that resembles the opening of that tactic. Posting as KarlaGod, the founder says participants in a Google Meet call claim they cannot see or hear them, then propose switching to a purported Zoom link that the founder identifies as phishing.

An Investment Meeting Turns Into a Platform Switch

The contact begins through Boardy, a professional networking service, and a conversation with someone claiming to be a fund's chief investment officer. The founder says the investment offer raises suspicions, while the contact's sparse professional profile and claimed fund prove difficult to corroborate.

The first invitation purportedly leads to Microsoft Teams, but the founder says its address is not a Microsoft domain. They request Google Meet instead and join the replacement call.

'They sent a Google Meet link, got on it to act like it "wasn't working."' The founder says the participants then suggest Zoom and supply another link.

The founder identifies that destination as a phishing page and reports the contact to Boardy, requesting that the profile be removed and flagged. A supplied reply attributed to Boardy acknowledges making the introduction but gives no details of subsequent action.

Fake Fixes Prompt Victims to Run Malware

In the operation described by the security report, an imitation meeting interface presents an audio problem while the attacker messages the target with instructions. The apparent assistance can include a small downloadable file or a command to paste into the terminal, an application used to enter system instructions.

Executing the proposed fix retrieves malware from attacker-controlled servers. The meeting supplies both the reason to act and someone who can answer questions, making a software-execution request resemble ordinary technical support.

The Swiss National Cyber Security Centre documents actual infections through a related fake-update method in a June advisory. In one case, a scammer posing as a prospective property applicant claims a legitimate Zoom link does not work and supplies a replacement.

That link leads to an imitation Zoom website demanding an urgent update, followed by a page copying the Microsoft Store. The target installs the supposed update and, with it, malware.

The imitation extends to the browser itself. A window and address bar drawn inside the malicious page create the impression of a genuine website, so inspecting that apparent address cannot authenticate it: the displayed controls belong to the deception, not the actual browser.

Meeting Pressure Makes Malicious Updates Look Routine

The advisory explains how the timing strengthens the request. Someone is waiting, the meeting may matter for work and the apparent technical fault needs resolving before the conversation can continue.

An update prompt also borrows credibility from a familiar security habit. Keeping software current is normally responsible behaviour; the attackers turn that expectation into a reason to run something supplied through their page.

The consequences can outlast the abandoned call. Supposed updates can conceal remote-access software that enables data theft, further malware downloads or ransomware deployment within an organisation, the agency warns.

Its advice is to join meetings directly through an installed application where possible and obtain updates through installed software or official websites. That separates the decision to attend a meeting from the decision to change what runs on a device: a waiting caller is not authority for a software installation.

Frequently Asked Questions

• What are fake Zoom and Microsoft Teams meetings?
  These are phishing scams where attackers simulate technical issues to trick users into downloading malware.
• How do attackers use fake meeting links?
  Attackers provide fake links to phishing pages that mimic legitimate meeting platforms to steal information or install malware.
• What should you do if you suspect a phishing attempt during a virtual meeting?
  Verify the meeting link, avoid downloading files or running commands, and report suspicious activity to the platform.