Slow Fog: Beware of Phishing Attacks Disguised as Zoom Meeting Links

ChainCatcher message, Slow Mist tweeted to remind users to be vigilant against phishing attacks disguised as Zoom meeting links, where attackers use the domain "app[.]us4zoom[.]us" to impersonate legitimate Zoom meeting links. The webpage closely mimics the real Zoom meeting interface, and when users click the "Start Meeting" button, it triggers the download of a malicious installation package instead of launching the local Zoom client. Hackers collect user data and decrypt it to steal sensitive information such as mnemonic phrases and private keys. These attacks often combine social engineering and trojan techniques.