Malware operators Zoom’ing in

This report documents a drive-by malware campaign where attackers host a malicious Zoom installer (zoom-free2.com) that drops a legitimate Zoom binary and nanohost.exe (an ARKEI/VIDAR infostealer). The infostealer performs system and hardware reconnaissance, harvests browser and FTP credentials, performs geolocation lookups via ip-api.com, downloads additional DLLs from its C2 (wrangellse.com), and exfiltrates collected data; the report provides hashes, file paths, network IOCs, a YARA detection, MITRE ATT&CK mappings, and recommended mitigations such as downloading Zoom only from the official site.