Scammers actively targeting real estate agents with remote access attacks · Blog · Sublime Security

This report describes a targeted email campaign against real estate agents in which attackers build trust via contact forms or cold outreach and then send lookalike Zoom links that download remote access tool installers (e.g., zoomworkspace.vbs) to give the attacker control of victims' systems; the report includes example messages, domains (webzoom.im, sjoinzoom.us, pacl.us) and behavioral detection signals used to block these attacks.