Fake software update lures: how a fake Zoom update hands over a computer

What the visitor sees

The page in NSS-ZM-01 draws a desktop window titled "Zoom Cloud Meetings" inside the browser, with the Zoom camera icon and a version line, "Version 5.2.3". It says: "Update Required. Your app version needs to be 5.3.0 or higher to join this meeting."

There are two buttons. Update is a plain link to an installer. Cancel only shows a message.

The lure borrows a moment the visitor expects. Someone joining a meeting is used to being told to update, and wants to get in quickly.

Why it passes a quick check

The page needs no script to do harm. It asks for no password and sets no cookie. It is 8,912 bytes and served the same page to a desktop, a phone and a crawler, so it does not hide from scanners.

That is the point to take away. A scanner that looks for a password form or a cloaked page finds nothing here. The harm is the file.

How the name is built

The lure sat on zoom-0xcdlive-join-00ccxxd[.]live. A name with "join" and a meeting-style code in it is made to sit in a meeting invitation sent by email or message. NSS did not see how visitors reached it.

The name was registered on 11 November 2026 at 14:31 UTC. Its first certificate followed 23 minutes later. It arrived in NSS's next daily list of newly registered names at 04:08 UTC on 12 November, and NSS's brand rule matched Zoom beside the word "join".

The lure name was bought at a different registrar from the operator's own domains and placed on a shared hosting platform. Its address serves unrelated sites, so it is not a block rule.

What the download is

The Update button downloads ScreenConnect.ClientSetup.msi, a Windows Installer package of 15,216,640 bytes. It is a remote-access client for a legitimate remote-support product, set to connect back to a server its sender runs. Whoever runs it hands over control of their computer.

No exploit is needed. The visitor installs the tool themselves. The page on remote-access tool abuse explains the server side.

How NSS rated it, step by step

The first casefile, at 04:34 UTC on 12 November, read Suspicious. NSS had captured the page and recorded the installer link.

At about 10:07 UTC NSS added a rule: a brand lookalike that offers an installer is rated malware delivery. The page and the download host moved to High risk.

At 13:11 UTC NSS fetched the installer once, read where it connects and deleted it. It was never run. The connect-back host, its domain and the server moved to High risk, 22 hours 40 minutes after the lure was registered. None of the nine indicators was on any list NSS holds on 12 November 2026.

Seen before

The method is not new. NSS searched its library of past reporting. It found public reports from August 2026 of fake Zoom updates handing out the same remote-support tool, and reports of state groups using a Zoom update lure with other payloads.

NSS found none of ZM-01's names, addresses, file hash or client id in those reports. The match is in method only, so the paper links the operator to no group. See attribution.

One detail stays open. The Cancel button shows "You cancelled the demonstration." NSS cannot tell a lure kit from an authorised phishing test. Either way, a remote-access client calling a server you do not own is an incident.

In ATT&CK terms

The paper maps what NSS saw to these techniques:

• T1036 Masquerading: a web page drawn as a Zoom desktop window and a fake update.
• T1204.002 User Execution: Malicious File: the visitor must download and run the installer.
• T1608.001 Stage Capabilities: Upload Malware: the installer staged on the sender's own portal.

What a defender can look for

• Pages that draw a desktop app window inside the browser and offer an installer, on a name that is not the vendor's.
• Meeting-style names with a brand and a word such as "join", registered in the last few days.
• An installer downloaded from a host that is not the vendor's, straight after a visit to a meeting link.
• The file hash and the names in the paper's indicator list, at DNS and on endpoints.
• Staff guidance: Zoom updates come from the Zoom app or zoom[.]us, never from a page that opens from a meeting link.