Click, Install, Compromised: The New Wave of Zoom-Themed Attacks

Summary

Threat actors are exploiting fake Zoom meeting invitations to deliver a malicious VBS downloader that installs ConnectWise ScreenConnect, a legitimate remote access application. The VBS payload downloads the ScreenConnect MSI from attacker-controlled infrastructure and launches it from the victim’s TEMP directory. After the remote access tool is installed, the attackers gain persistent access to the system, enabling credential theft, reconnaissance, and delivery of follow-on malware such as ransomware.

Investigation

Cofense identified phishing emails that directed victims to a counterfeit Zoom page prompting them to install a fake update. That update delivered a VBS file named _zoommeeting_Zoom_Installer_64_bit.exe.vbs, which contained a hard-coded URL pointing to a malicious IP address hosting the ScreenConnect.ClientSetup.msi installer. The script then executed the MSI through Windows Script Host in a hidden window to avoid drawing attention.

Mitigation

Organizations should deploy email security controls that can detect and block Zoom-themed phishing lures, require multi-factor authentication for remote access tools, and restrict execution of VBS scripts from user-writable directories. Defenders should also monitor network traffic for communication with known malicious domains and IPs and apply application allow-listing to control legitimate remote administration software.

Response

If this activity is detected, isolate the affected endpoint immediately, remove the malicious VBS file and any installed ScreenConnect components, and reset compromised credentials. Investigators should then perform forensic analysis to determine whether additional malware was deployed or whether data was exfiltrated. Remote access policies should also be reviewed and hardened, and detection content should be updated with the observed indicators of compromise.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

Attack Narrative & Commands

1. Initial Delivery: The victim receives a phishing email titled “Zoom Meeting – Install Update”. The attachment is a VBS script named _zoommeeting_Zoom_installer_64_bit.exe.vbs.
2. Execution: The user double‑clicks the VBS file, which invokes cscript.exe to run the script. The script drops two payloads in %TEMP%:
   • ScreenConnect.ClientSetup.msi – the malicious Remote Access Tool installer.
   • A secondary PowerShell back‑door (not part of this rule).
3. Installation: The VBS script silently launches msiexec.exe to install the ScreenConnect.ClientSetup.msi with /quiet. This creates a new process creation event whose Image ends with ScreenConnect.ClientSetup.msi, satisfying the rule condition.

Regression Test Script

# --------------------------------------------------------------
#  Simulation Script – Triggers "ScreenConnect.ClientSetup.msi"
#  and "_zoommeeting_Zoom_installer_64_bit.exe.vbs" detections
# --------------------------------------------------------------

# 1. Prepare payloads (in a real test these would be the malicious files)
$payloadDir = "$env:TEMPZoomPhish"
New-Item -Path $payloadDir -ItemType Directory -Force | Out-Null

# Dummy files to emulate the malicious names (hashes can be added later)
$msiPath   = Join-Path $payloadDir "ScreenConnect.ClientSetup.msi"
$vbscript  = Join-Path $payloadDir "_zoommeeting_Zoom_installer_64_bit.exe.vbs"

# Create empty placeholder files (replace with real payloads for live test)
New-Item -Path $msiPath -ItemType File -Force | Out-Null
Set-Content -Path $vbscript -Value @"
' VBS dropper – writes the MSI to disk and launches it
Set objFSO = CreateObject("Scripting.FileSystemObject")
strTemp = objFSO.GetSpecialFolder(2) ' %TEMP%
objFSO.CopyFile "%~dp0ScreenConnect.ClientSetup.msi", strTemp & "ScreenConnect.ClientSetup.msi"
Set objShell = CreateObject("WScript.Shell")
objShell.Run "msiexec /i """ & strTemp & "ScreenConnect.ClientSetup.msi"" /quiet", 0, False
"@ -Encoding ASCII

# 2. Execute the VBS dropper (this will in turn launch msiexec)
cscript.exe //B //Nologo $vbscript

Write-Host "`n[+] Simulation executed – detection should fire now." -ForegroundColor Green

Cleanup Commands

# --------------------------------------------------------------
#  Cleanup – removes artifacts created by the simulation
# --------------------------------------------------------------

$payloadDir = "$env:TEMPZoomPhish"

# Stop any lingering msiexec processes started by the test
Get-Process -Name msiexec -ErrorAction SilentlyContinue | Stop-Process -Force

# Remove temporary files and directory
Remove-Item -Path $payloadDir -Recurse -Force -ErrorAction SilentlyContinue

Write-Host "`n[+] Cleanup complete." -ForegroundColor Yellow