Fake Zoom and Google Meet Pages Trick Users Into Installing Monitoring Tool

Security researchers documented an active phishing campaign that clones Zoom and Google Meet waiting rooms (and a fake Microsoft Store UI) to prompt victims to install an “update” which deploys a stealthy remote monitoring/spyware agent. The agent (installed from a repurposed legitimate employee-monitoring tool) provides keystroke logging, screenshots, browsing and file access, hides from the Programs list/tray, and maintains persistence via services named "tsvchst" and "pmon," enabling unauthorized surveillance of infected Windows systems.