This spyware was then injected into MSBuild.exe, a platform used to build applications. Once executed, it dropped two payloads: The legitimate software installer and malware named Decoder.exe, which then dropped Vidar malware. It isn't clear how users encountered these fake download sites, but those that did downloaded a file called Zoom.exe. According to idClickThat, the only difference between the home page of the fake Zoom download sites and the real one is the addition of a 'download' button in the main image.

Findings reveal six fake Zoom download sites, but they are no longer accessible. Vidar steals user credentials, banking information, saved passwords, IP addresses, and other sensitive information. Malware downloads 🤖 /zoom-download.host /zoom-download.space /zoom-download.fun /zoomus.host /zoomus.tech /zoomus.website PDR /JYq2UJEMQ7įurther analysis from researchers at Cyble reveals this spyware is known as the Vidar Stealer, which it did a deep-dive on last year. This particular campaign, initially discovered by an Internet researcher going by the handle gets unsuspecting users to download an information-stealer- spyware, if you prefer-from fake sites hosting malformed Zoom installers (malware bundled with a legitimate Zoom installer) onto their work systems. It's no surprise then to see criminals continuing to abuse Zoom's popularity, in the hope of netting interested parties and, potentially, luring current users into downloading and installing malware. Despite a slow, post-lockdown easing back to the 'old normal,' many businesses still have remote workers, or people working in different geographies. Zoom video call software continues to be a staple in work environments.

Zoom app ireland download for pc