uswebzoomus[.]com

UPDATE (February 27, 2026): We have added more clarity around the abuse of legitimate commercial products, and of Teramind’s stealth mode. Important note: Teramind, the software vendor referenced in this article, has stated they are not affiliated with the threat actors described, did not deploy the software referenced, and condemn any unauthorized misuse of commercial monitoring technologies. Teramind is a legitimate commercial product with lawful enterprise use cases. February 24, 2026, we published an article about how a fake Zoom meeting “update” silently installs monitoring software, documenting a campaign that used a convincing fake Zoom waiting room to push a legitimate Teramind installer abused for unauthorized surveillance onto Windows machines. Following publication of our findings, the malicious domain was reported to its domain name registrar, Namecheap, which confirmed it suspended the service. Despite the takedown, our continued monitoring shows the campaign is not only still active but growing: we have now identified a parallel operation impersonating Google Meet, running from a different domain and infrastructure. In this article, we’ll provide the deeper technical analysis behind both variants, cataloguing the use of Teramind instance IDs by scammers that we have directly observed or collected from sandbox repositories, document our hands-on detonation of the installer in a controlled environment, and answer a question that emerged during our research: How can a single, identical Windows installer package serve several different attacker accounts? The campaign expands to Google Meet While the original Zoom-themed site at uswebzoomus[.]com was taken down by Namecheap following community reporting, a second site at googlemeetinterview[.]click is actively deploying the same payload using an identical playbook adapted for Google Meet. The Google Meet variant presents a fake Microsoft Store page branded as “Google Meet for Meetings” published by “Google Meet Video Communications, Inc,” which is a fabricated entity. A “Starting download…” button is displayed while the MSI file is silently delivered via the path /Windows/download.php. The referring page is /Windows/microsoft-store.php, confirming the fake Microsoft Store screen is served by the attacker’s infrastructure, not by Microsoft. Our Fiddler traffic capture of the Google Meet variant shows the response header: Content-Disposition: attachment; filename="teramind_agent_x64_s-i(__06a23f815bc471c82aed60b60910b8ec1162844d).msi". Unlike the Zoom variant, where the filename was disguised as a Zoom component, this variant does not even attempt to hide the scammer’s abuse of Teramind in the filename. We verified both files are byte-for-byte identical (MD5: AD0A22E393E9289DEAC0D8D95D8118B5), confirming a single binary is being served across both campaigns with only the filename changed. Infrastructure differences between variants Despite using the same payload, the two variants are hosted on different infrastructure. The Zoom variant at uswebzoomus[.]com ran on Apache/2.4.58 (Ubuntu) and was registered through Namecheap on 2026-02-16. The Google Meet variant at googlemeetinterview[.]click runs on a LiteSpeed server. Both serve the download via PHP scripts and use the same fake Microsoft Store redirect pattern, but the switch in web server and domain registrar suggests the operator anticipated takedowns and pre-positioned fallback infrastructure. One binary, many identities. How the installer reads its own filename During our investigation, we identified 14 distinct MSI filenames sharing the same SHA-256 hash. Of these, two were directly captured from malicious infrastructure through our malware domain analysis: the Zoom variant from uswebzoomus[.]com and the Google Meet variant from googlemeetinterview[.]click. The remaining filenames were sourced from sandbox repositories. It is important to note that some of these sandbox-sourced filenames may represent legitimate corporate Teramind deployments rather than malicious activity. Teramind is a commercial product with lawful enterprise use cases, and files submitted to sandbox services do not necessarily indicate abuse. Nevertheless, they all share the same binary and demonstrate the same filename-based configuration mechanism. Every file shares the same SHA-256 hash: 644ef9f5eea1d6a2bc39a62627ee3c7114a14e7050bafab8a76b9aa8069425fa. This raised an immediate question: if the Teramind instance ID changes with every filename, but the binary is byte-for-byte identical, where is the ID actually stored? The answer lies in a .NET custom action embedded inside the MSI. Our behavioral analysis reveals the following sequence: Calling custom action Teramind.Setup.Actions!Teramind.Setup.Actions.CustomActions.ReadPropertiesFromMsiName PROPERTY CHANGE: Modifying TMINSTANCE property. Its current value is 'onsite'. Its new value: '__941afee582cc71135202939296679e229dd7cced'. PROPERTY CHANGE: Adding TMROUTER property. Its value is 'rt.teramind.co'. The MSI ships with a default TMINSTANCE value of onsite. This is the standard Teramind on-premise default. At install time, the ReadPropertiesFromMsiName custom action parses the installer’s own filename, extracts the 40-character hex string from the s-i(__) portion, and overwrites the default with the attacker-specific instance ID. The log also shows the message Failed to get router from msi name. The installer attempted to extract a C2 server address from the filename but could not. In this case, it falls back to the default value rt.teramind.co, which is preconfigured inside the MSI. However, TMROUTER is an exposed MSI property, so it could potentially be overridden at install time or changed in a different build. The filename in this campaign carries only the instance ID; the C2 destination is determined by the MSI’s default configuration. Live detonation: what the installer actually does on a real system To go beyond sandbox-based behavioral analysis, we detonated the MSI installer in an isolated Windows 10 virtual machine with verbose MSI logging enabled, ApateDNS for DNS interception, and Fiddler for network monitoring. This hands-on analysis revealed several critical behaviors not visible in automated sandbox reports. Installation chain and the CheckHosts gate The MSI installer progresses through four .NET custom actions in sequence, all executed via the WiX Toolset’s zzzzInvokeManagedCustomActionOutOfProc mechanism: ReadPropertiesFromMsiName: Parses the MSI’s own filename to extract the Teramind instance ID and overwrites the default onsite value CheckAgent: Determines whether a Teramind agent is already installed on the machine ValidateParams: Validates the extracted configuration parameters CheckHosts: Performs a pre-flight connectivity check against the C2 server rt.teramind.co The CheckHosts action is a hard gate: if the installer cannot reach the Teramind server, installation aborts with error code 1603. Our initial detonation attempt in a network-isolated VM failed at exactly this point: TM: TMINSTANCE = __941afee582cc71135202939296679e229dd7cced TM: TMROUTER = rt.teramind.co CustomAction CheckHosts returned actual error code 1603 This behavior is significant for two reasons. First, it reveals the C2 server address: rt.teramind.co. Second, it means that victims on corporate networks with restrictive DNS or outbound filtering may be inadvertently protected. The installer will silently fail if it cannot phone home during installation. However, the MSI does support a TMSKIPSRVCHECK property that can bypass this check, and its default value is no. To complete our analysis, we added rt.teramind.co to the Windows hosts file pointing to localhost, allowing the DNS resolution to succeed and the CheckHosts action to pass. The installation then completed successfully. Stealth mode confirmed The successful installation log confirms what the original article suspected: Teramind’s stealth mode (called Hidden Agent, a deployment option that runs silently in the background) is enabled by default in this build. Hidden or stealth deployment modes are standard features in legitimate enterprise endpoint monitoring products, typically used for insider threat detection or compliance monitoring with appropriate employee notice and consent. In this campaign, however, threat actors can abuse this feature to deploy the agent without victim knowledge. The MSI property dump shows: Property(S): TMSTEALTH = 1 This confirms the agent installs with no taskbar icon, no system tray entry, and no visible entry in the Windows Programs list. The victim has no visual indication that monitoring software is running. Two services, not one The install log reveals the campaign deploys two persistent services, not just the one documented in our original article: Both service names are chosen to blend in: tsvchst mimics the legitimate Windows svchost.exe naming pattern, while pmon with the display name “Performance Monitor” mimics the built-in Windows Performance Monitor. Both run as LocalSystem, the highest privilege level on a Windows machine. Both services are configured with aggressive failure recovery: restart on first failure, restart on second failure, and restart on subsequent failures, with delays of 160 seconds (tsvchst) and 130 seconds (pmon). This means even if a user or security tool terminates the service, it automatically restarts within minutes. Live C2 callback observed Immediately after installation, ApateDNS captured the agent phoning home. DNS queries for rt.teramind.co appeared within seconds of the service starting, confirming the agent begins its callback cycle immediately. The queries repeated at approximately 11-second intervals, showing a persistent polling pattern. In a real-world scenario where the victim has internet connectivity, these would resolve to Teramind’s infrastructure and the agent would begin transmitting captured data. Full MSI configuration surface The verbose installation log exposes every configurable parameter the MSI supports through its SecureCustomProperties list. This reveals the installer’s full configuration surface: TMSTEALTH — Stealth mode (set to 1 in this build) TMINSTANCE — Account identifier (extracted from filename) TMROUTER — C2 server address (hardcoded to rt.teramind.co) TMENCRYPTION — C2 communication encryption toggle TMSOCKSHOST / TMSOCKSPORT / TMSOCKSUSER / TMSOCKSPASSWORD — Built-in SOCKS5 proxy support for tunneling C2 traffic through proxies TMHTTPPROXY — HTTP proxy support TMSKIPSRVCHECK — Skip the C2 connectivity pre-flight check TMNODRV / TMNOFSDRV — Disable kernel filter drivers TMNOIPCCLIPBOARD — Clipboard monitoring toggle TMNOREMOTETS — Remote terminal services monitoring toggle TMHASHUSERNAMES — Anonymize/hash captured usernames TMDISABLESCREEN — Disable screenshot capture TMADDENTRYTOARP — Add/remove entry from Add/Remove Programs (off in stealth) TMCRASHUPLOADURL — Crash telemetry upload endpoin TMREVEALEDPASSWORDLESS — Toggle for passwordless reveal functionality The SOCKS5 proxy support is particularly noteworthy from a threat perspective. While proxy configuration is a standard enterprise feature—allowing organizations to route agent traffic through corporate infrastructure—in this context it means the agent could be configured to route captured data through an attacker-controlled proxy, making network-level detection significantly harder by disguising C2 traffic as legitimate proxy traffic. Observed Teramind instance IDs The following table lists every MSI filename and corresponding Teramind instance ID we have collected. Of these, two were directly observed in the wild through our own malware domain analysis: the Zoom variant (941afee…7cced, captured from uswebzoomus[.]com) and the Google Meet variant (06a23f8…2844d, captured from googlemeetinterview[.]click). The remaining filenames were sourced from sandbox repositories. As noted above, some of these may represent legitimate enterprise deployments rather than malicious use. All files share the same SHA-256 hash. Two filenames share the same instance ID c0cea71…0a6d7, indicating the same attacker account was used across multiple filename variations. The variety of filename prefixes is notable: zoom_agent, ZoomApp_agent, GoogleMeet_agent, AdobeReader_agent, teramind_agent, and file_agent. This suggests the campaign extends beyond video conferencing impersonation. However, the AdobeReader-branded variant was found only in sandbox repositories and may represent testing or planned expansion rather than an active deployment. The filenames with generic prefixes like teramind_agent and file_agent similarly appear to be sandbox submissions that retained the default naming rather than a brand-specific social engineering lure. Indicators of Compromise File hashes SHA-256: 644ef9f5eea1d6a2bc39a62627ee3c7114a14e7050bafab8a76b9aa8069425fa MD5: AD0A22E393E9289DEAC0D8D95D8118B5 Domains uswebzoomus[.]com (Zoom variant: taken down by Namecheap) googlemeetinterview[.]click (Google Meet variant: active as of 2026-02-26) Detection and defense recommendations Alert on the ProgramData GUID directory {4CEC2908-5CE4-48F0-A717-8FC833D8017A} . This GUID is fixed across all observed variants. Query for both services: sc query tsvchst andsc query pmon . Either running on a non-corporate machine confirms active surveillance. Watch for kernel driver loads: tm_filter.sys andtmfsdrv2.sys loading on personal machines should trigger high-severity alerts. Block MSI execution from browser download directories. Both variants rely on the user running an MSI from their Downloads folder. Application control policies that prevent MSI execution from user-writable paths would stop this attack chain. Educate employees: Never update applications by clicking links in messages. Use the application’s built-in update mechanism or navigate to the vendor’s official website manually. Deploy browser policies that warn on or block automatic file downloads from unrecognized domains. Removal To uninstall the agent, run the following command as Administrator: msiexec /x {4600BEDB-F484-411C-9861-1B4DD6070A23} /qb. This removes the services, kernel drivers, and most installed files. However, our testing confirmed the uninstaller fails to fully delete the ProgramData directory due to runtime-generated files. After uninstalling, manually remove any remnants with rmdir /s /q "C:\ProgramData\{4CEC2908-5CE4-48F0-A717-8FC833D8017A}" and reboot to fully unload the kernel drivers from memory. Conclusion This campaign demonstrates a growing trend: the abuse of legitimate commercial software for malicious purposes. The attackers did not write custom malware. Instead, they took an off-the-shelf monitoring product—one designed for lawful enterprise use—and abused its built-in stealth mode and filename-based configuration system, wrapping it in social engineering designed to exploit trust in brands like Zoom and Google Meet. This type of abuse can affect any legitimate software vendor and underscores the importance of user education about social engineering tactics. The expansion to Google Meet, plus additional sandbox-sourced variants including an AdobeReader-branded filename, suggests this is an evolving operation that may expand to impersonate other applications. Our hands-on detonation revealed details invisible to automated sandboxes: the CheckHosts C2 pre-flight gate, the rt.teramind.co router address, the second pmon service masquerading as Performance Monitor, the confirmed TMSTEALTH = 1 flag, and the full SOCKS5 proxy capability for C2 evasion. The fact that a single binary serves unlimited attacker accounts through nothing more than a filename rename makes this campaign easily scalable. Acknowledgments We would like to thank security researcher @JAMESWT_WT for promptly reporting the original malicious domain to Namecheap, leading to the takedown of uswebzoomus[.]com. Teramind has confirmed that the company was not involved in this campaign and had no knowledge of or affiliation with the threat actors. Like many legitimate commercial software products, Teramind can be abused by malicious actors—a risk that exists across the enterprise software ecosystem. Because Teramind is a legitimate commercial product, it is not inherently flagged by security software, meaning we have no visibility into whether this campaign has resulted in real-world infections. What we can confirm is that the infrastructure we documented—including purpose-built phishing domains impersonating Zoom and Google Meet, fake Microsoft Store pages, and a Teramind agent configured in stealth mode—is consistent with a campaign designed to deploy monitoring software onto targets’ machines without their knowledge or consent.

Malwarebytes researchers have uncovered a fake (but convincing) Zoom meeting page that downloads surveillance software on Windows computers and tricks users into running it. According to Microsoft MVP Steven Lim, the page has claimed nearly 1,500 victims in 12 days. The trick Potential victims likely visit the page (at uswebzoomus[.]com/zoom/) after getting a meeting invite/link via email or text. The page is made to look like a Zoom waiting room and, once a visitor interacts … More → The post Fake Zoom meeting leads to silent install of surveillance software appeared first on Help Net Security .

UPDATE (February 27, 2026): We have added more clarity around the abuse of legitimate commercial products. UPDATE (February 25, 2026): Teramind has stated that it is not affiliated with the threat actors described and did not authorize the deployment of the software referenced. Further updates have been made throughout for clarification. A fake Zoom meeting website is silently pushing surveillance software onto Windows machines. Visitors land on a convincing imitation of a Zoom video call. Moments later, an automatic “Update Available” countdown downloads a malicious installer—without asking for permission. The scam campaign pushes a Teramind installer, which is a legitimate product and commercial workforce monitoring solution companies use to record what employees do on work computers, to unsuspecting victims. In this cybercriminal campaign, however, which Teramind has no affiliation with, the abused and altered program is being quietly dropped onto the machines of ordinary people who thought they were joining a meeting. You clicked a Zoom link but there was no meeting The whole operation starts at uswebzoomus[.]com/zoom/, a website that opens as a Zoom waiting room. The moment it loads, it quietly sends a message back to the attackers letting them know someone has arrived. Three scripted fake participants—“Matthew Karlsson,” “James Whitmore,” and “Sarah Chen”—appear to join the call one by one, each announced by a genuine-sounding Zoom join chime. Their conversation audio loops on repeat in the background. The page behaves differently if no one interacts with it. The audio and meeting sequence only begin once a real person clicks or types. Automated security tools that scan suspicious pages without interacting may see nothing unusual. A permanent “Network Issue” warning is displayed over the main video tile. This is not a glitch: the page is hardcoded to always show it. The choppy audio and lagging video are entirely deliberate, and they serve a specific psychological purpose. A visitor sitting through a broken call will naturally assume something is wrong with the app. When an “Update Available” prompt appears moments later, it feels like the fix. The countdown nobody asked for Ten seconds after the meeting screen appears, a pop-up takes over: “Update Available — A new version is available for download.” A spinner turns and a counter ticks from five to zero. There is no close button. By this point the visitor has already sat through a frustrating, glitchy call—and a software update is exactly what they have been primed to want. The pop-up arrives not as a surprise, but as an answer. When the counter hits zero, the browser is instructed to silently download a file. At the exact same moment, the page switches to what looks like the Microsoft Store showing “Zoom Workplace” mid-installation, spinning and all. While the visitor watches what appears to be a legitimate install resolving the problem, the real installer has already landed in their Downloads folder— and it didn’t ask for permission at any point. A Zoom update with Teramind inside The downloaded file is called zoom_agent_x64_s-i(__941afee582cc71135202939296679e229dd7cced) (1).msi. It’s a standard Windows installer format. Its unique digital fingerprint is 644ef9f5eea1d6a2bc39a62627ee3c7114a14e7050bafab8a76b9aa8069425fa. The filename itself is telling: the string s-i(__) copies Teramind’s own naming convention for a stealth instance installer, with the hash after it identifying the specific attacker-controlled Teramind account the agent will report back to. Security analysis of the file’s contents revealed two particularly telling pieces of text hidden inside it: Agent version 26.3.3403 and a field labelled Server IP or host name. These fields confirm the installer was preconfigured to connect to an attacker-controlled Teramind server. The installer executes through Windows Installer without presenting a typical interactive consumer installation interface. The target being set up as a surveillance target has no idea it is happening. Built to be invisible Inside the installer’s internal build files—notes left over from the development process that are normally only seen by the software’s authors—the folder name out stealth appears in the build path. This indicates the attackers configured the installer using Teramind’s “stealth mode” deployment option, a legitimate enterprise feature designed for authorized IT deployments where an invisible agent is required. However, in this criminal campaign, that feature is being misused to avoid detection on victims’ personal devices. In this version of the Windows agent, Teramind’s MSI defaults to naming the agent binary dwm.exe and installs it under a ProgramData\{GUID} directory. This behavior is documented by the vendor and can be changed using the TMAGENTEXE installer parameter. During installation, the software assembles itself in stages. Several Teramind components are unpacked into temporary directories during installation. These intermediate files are not individually signed, which can sometimes trigger security tooling during analysis. The installation chain first confirms whether Teramind is already on the machine, then collects the computer’s name, the current user account, the keyboard language, and the system locale. These are the details Teramind needs to identify the device and begin reporting activity back to whoever deployed it. The agent is configured to communicate with a remote Teramind server instance, consistent with enterprise monitoring deployments. Designed to fool the tools that would catch it One of the most deliberate aspects of this installer is how hard it works to avoid being analyzed. Security researchers examine suspicious software in controlled “sandbox” environments (essentially isolated virtual machines where the software can run safely while being watched). This installer is built to detect exactly that situation and behave differently. Runtime analysis flags indicate the presence of debug and environment detection logic (DETECT_DEBUG_ENVIRONMENT). The installer performs checks consistent with identifying analysis or sandbox environments and may alter its behavior under those conditions. Once installation completes, the installer removes its temporary files and staging folders. That means by the time someone checks the machine, obvious traces of the installer may already be gone. The monitoring agent itself, however, continues running in the background. What makes this cybercriminal campaign unusually dangerous Teramind is a legitimate software vendor whose purpose serves a function. Businesses pay for it to monitor staff on company-owned devices: it logs every keystroke, takes screenshots at regular intervals, records which websites were visited and which applications were opened, captures clipboard contents, and tracks email and file activity. In a corporate context—where employees are informed and policies are in place—this is legal. But here, cybercriminals misuse the Teramind tool and secretly installing the software on personal machines without authorization. The attackers did not write custom malware. They deployed a professionally developed commercial product that is designed to run reliably and persist through restarts. That makes it more durable than many traditional scams. Because the files themselves belong to legitimate software, there is no malicious code for traditional antivirus tools to detect. Rather, this is a situation where context matters. Here the scammers are misusing Teramind’s legitimate monitoring software by installing it without consent on a personal device of a victim without their knowledge. What to do if you may have been affected If you visited uswebzoomus[.]com/zoom/ and a file with the name above was downloaded: Do not open it. If you already ran it, treat your device as compromised. Check for the installation folder: Open File Explorer. Navigate to C:\ProgramData . Look for a folder named {4CEC2908-5CE4-48F0-A717-8FC833D8017A} . ProgramData is hidden by default. In File Explorer, select View and enable “Hidden items.” Check whether the service is running: Open Command Prompt as administrator. Type: sc query tsvchst Press Enter. If it shows STATE: 4 RUNNING, the agent is active. If the service does not exist, it was not installed using the default configuration. Change passwords for important accounts—email, banking, and work—from a different, clean device. If this happened on a work computer, contact your IT or security team immediately. To avoid similar attacks in the future: Open Zoom directly from the app on your device. Type zoom.us into your browser yourself instead of clicking unexpected links. Be cautious with meeting links you were not specifically expecting. Closing thoughts There is a quiet but growing trend of attackers abusing and misusing legitimate commercial software. Tools like Teramind arrive on a machine and avoid detection by traditional antivirus tools because such tools are legitimate and credible, and that credibility is exactly what makes them useful to a bad actor deploying them without permission. This cybercriminal campaign does not rely on technical sophistication. No new hacking technique was used. The attacker built a convincing fake Zoom page, set an automatic download to fire before any visitor has a reason to be suspicious, and used a fake Microsoft Store screen to explain it all away. From click to install takes less than thirty seconds. Someone who was expecting a Zoom invite and saw what looked like a Microsoft installation in progress could easily walk away believing nothing unusual had happened. Zoom is frequently impersonated because people receive meeting links through email, text, Slack, and calendar invites—and click quickly. Taking five seconds to confirm a link really leads to zoom.us is a simple habit that can prevent a serious problem. Indicators of Compromise (IOCs) File Hashes (SHA-256) 644ef9f5eea1d6a2bc39a62627ee3c7114a14e7050bafab8a76b9aa8069425fa Domains uswebzoomus[.]com Teramind Instance ID 941afee582cc71135202939296679e229dd7cced