Fake Zoom and Google Meet Phishing Campaigns Deploy Teramind Surveillance Software

Threat actors are running phishing lures impersonating Zoom and Google Meet to silently install an unmodified Teramind MSI in “Hidden Agent” mode on Windows hosts; the installer extracts an instance ID from the filename, checks connectivity to a hardcoded C2 (rt.teramind.co), and only proceeds if reachable. The deployed implant hides UI, exposes SOCKS5 proxy support, installs resilient LocalSystem services (tsvchst/pmon), loads kernel drivers (tm_filter.sys, tmfsdrv2.sys), and includes IOCs (file hashes, domains, service names and a ProgramData GUID) along with recommended mitigations and removal steps.