Phishing Campaigns Target Users with Fake Meeting Invites and Update Alerts via Zoom, Teams, and Google Meet

Ongoing phishing campaigns impersonate Zoom/Teams/Google Meet invites and prompt victims to install a fake “critical update” that installs legitimately signed RMM software (e.g., Datto RMM, LogMeIn, ScreenConnect), enabling attackers persistent remote access for data theft, lateral movement, and possible ransomware deployment; attackers use typo‑squatted domains and convincing fake meeting/login pages, and Netskope Threat Labs recommends monitoring RMM usage, restricting admin privileges, and ensuring updates come only from vendor domains.