Advanced fake Zoom installer used for delivering malware · Blog · Sublime Security

## Executive summary Sublime observed an active email campaign that impersonates Zoom meeting invites (likely AI-generated) and lures Windows users to an interactive JavaScript fake Zoom page; victims are coaxed to download a file named ZoomUpdateInstaller.msi which installs a maliciously-configured ScreenConnect remote access tool, granting attackers control of compromised systems. The report includes attack flow details, example JavaScript used to simulate attendees/voices, the malicious download URL structure, and detection signals used by Sublime's AI detection engine.