The NJCCIC received a report that threat actors compromised an account and sent fake Zoom meeting invitations with the subject line “Quick Zoom Meeting–Today.” The emails contained a malicious link that, if clicked, directed unsuspecting victims to download a file disguised as Zoom. If downloaded, an unauthorized version of a legitimate remote access tool was installed to control the device remotely, install malware, and steal information. Additionally, an Android spyware dropper was installed to request changes to device permissions and settings, including microphone, camera, location, and screen capture.
Recommendations
  • Exercise caution with unexpected or unsolicited communications, including those from known senders or legitimate services or platforms.
  • Confirm requests from senders using contact information obtained from verified, official sources before taking action, such as clicking links or opening attachments.
  • Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
  • Enable multi-factor authentication (MFA) and keep systems and browsers up to date.
  • If you suspect your device is infected, disconnect from the internet, run anti-virus/anti-malware scans, and review your security and privacy settings. A full system reimage may be warranted to restore the compromised device.
  • If sensitive information was entered, change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources.
  • Report malicious cyber activity to the NJCCIC and the FBI’s IC3.
.
Zoom In on This Scam
The NJCCIC identified an email campaign impersonating ZoomInfo, a legitimate business intelligence platform. The message, presented as a “Personal Information Notice,” resembles standard data privacy disclosures, such as GDPR or CCPA notices. It informs recipients that their professional data is being collected, processed, and shared with third-party B2B customers.
Analysis indicates that the sender’s domain was registered just 104 days before the email was sent, a likely indicator of phishing. The email contains suspicious links that embed the recipient’s email address in the URLs. This pattern is often used in phishing to track or target recipients.
To prompt a response, the email directs recipients to visit a “Trust Center” or click embedded links to opt out, access, or delete their profile. Rather than leading to legitimate corporate domains, the embedded hyperlinks pass through tracking and redirection domains and are wrapped by URL defense scanners, obscuring the links’ ultimate destinations. These phishing attempts can enable threat actors to obtain personally identifiable information (PII), account credentials, and financial information.
Recommendations
  • Exercise caution with communications from known senders or legitimate platforms.
  • Confirm requests from senders via contact information obtained from verified and official sources before taking action, such as clicking on links or opening attachments.
  • Navigate directly to legitimate websites and verify before submitting account credentials, providing personal or financial information, or downloading files.
  • Enable MFA and keep systems and browsers up to date.
  • If sensitive information was entered, change passwords for compromised accounts, monitor for unauthorized activity, and review the Identity Theft and Compromised PII NJCCIC Informational Report for additional recommendations and resources, including credit freezes.
  • Report malicious cyber activity to the NJCCIC and the FBI’s IC3.

Published in the NJCCIC Weekly Bulletin Nov. 5, 2026