Fake Zoom, Teams Meeting Invites Use Compromised Certificates to Drop Malware

**Executive summary:** Microsoft researchers reported a phishing campaign that leverages stolen Extended Validation code‑signing certificates to make malicious fake-updater binaries appear trusted; these binaries delivered RMM backdoors (ScreenConnect, MeshAgent) via meeting-invite lures and fake download pages, enabling persistent privileged access and enabling credential theft or ransomware — defenders should distrust email update prompts, verify distribution channels, and evaluate signatures alongside runtime behavior and reputational telemetry.