UPDATE (February 27, 2026): We have added more clarity around the abuse of legitimate commercial products. UPDATE (February 25, 2026): Teramind has stated that it is not affiliated with the threat actors described and did not authorize the deployment of the software referenced. Further updates have been made throughout for clarification. A fake Zoom meeting website is silently pushing surveillance software onto Windows machines. Visitors land on a convincing imitation of a Zoom video call. Moments later, an automatic “Update Available” countdown downloads a malicious installer—without asking for permission. The scam campaign pushes a Teramind installer, which is a legitimate product and commercial workforce monitoring solution companies use to record what employees do on work computers,…