Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Fake Zoom and Google Meet Phishing Campaigns Deploy Teramind Surveillance Software

## Cybersecurity: Phishing Campaigns Targeting Video Communication Tools

MBy Madison DrakeFeb 28, 20262 min read

Cybersecurity: Phishing Campaigns Targeting Video Communication Tools

Recent phishing campaigns are targeting video communication tools such as Zoom and Google Meet to deploy Teramind on Windows devices without user consent. Although Teramind is a legitimate enterprise monitoring product, it is being misused by malicious actors to conduct unauthorized surveillance.

The Infection Chain and Delivery Mechanism

The attacks use fraudulent landing pages that mimic legitimate video communication platforms. A previous campaign involved the domain uswebzoomus[.]com , while a current campaign is using googlemeetinterview[.]click . These sites display a fake Microsoft Store page, which facilitates the installation of a malicious MSI installer on the victim's device.

The attackers employ an unmodified Teramind binary. The installer uses a .NET custom action named ReadPropertiesFromMsiName to embed a 40-character hex string in the filename, extracting the attacker’s specific instance ID.

Upon execution, a connectivity check called CheckHosts is performed against the hardcoded Command and Control (C2) server rt.teramind.co . If the server is unreachable, the installation is aborted. Successful connections lead to the software being installed in "Hidden Agent" mode ( TMSTEALTH = 1 ).

The MSI also has built-in SOCKS5 proxy support, allowing attackers to obscure C2 traffic and evade network detection. The campaign uses resilient services to maintain persistence, automatically restarting if terminated.

Service Name Display Name Executable Privilege Level

tsvchst Service Host svc.exe -service LocalSystem

Recent phishing campaigns are targeting video communication tools such as Zoom and Google Meet to deploy Teramind on Windows devices without user consent.
Madison Drake · Thehackingpost

pmon Performance Monitor pmon.exe LocalSystem

Security teams should monitor for the following indicators associated with this campaign:

Type Indicator Description

SHA-256 644ef9f5eea1d6a2bc39a62627ee3c7114a14e7050bafab8a76b9aa8069425fa Malicious MSI Installer

MD5 AD0A22E393E9289DEAC0D8D95D8118B5 Malicious MSI Installer

Advertisement

Domain googlemeetinterview[.]click Active Google Meet Lure

Domain uswebzoomus[.]com Offline Zoom Lure

C2 Server rt.teramind.co Default C2 Callback

To identify compromised devices, look for the ProgramData directory GUID {4CEC2908-5CE4-48F0-A717-8FC833D8017A} . Security teams should alert on the tsvchst and pmon services on non-corporate machines or unexpected loading of the tm_filter.sys and tmfsdrv2.sys kernel drivers.

Organizations should block MSI executions from user download directories and implement browser policies to warn against unrecognized domains. To remove the unauthorized software, run msiexec /x {4600BEDB-F484-411C-9861-1B4DD6070A23} /qb , delete the associated ProgramData directory, and reboot the system.

Based on reporting by GBHackers.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026