SlowMist: Beware of phishing attacks disguised as Zoom meeting links, which will trigger the download of malicious installation packages.

According to Foresight News, SlowMist has issued a reminder to users to be alert to phishing attacks disguised as Zoom meeting links. Attackers use the domain name 'app[.]us4zoom[.]us' to impersonate legitimate Zoom meeting links. The webpage closely imitates the genuine Zoom meeting interface. When users click the 'Start Meeting' button, it triggers the download of a malicious installation package instead of launching the local Zoom client. Hackers collect user data and decrypt it to steal sensitive information, such as mnemonic phrases and private keys. These attacks typically combine social engineering and Trojan techniques.