Zoom Stealer browser extensions harvest corporate meeting intelligence
ID: bb238077-62e4-54ab-934c-f30b1a27a373
STIX ID: report--bb238077-62e4-54ab-934c-f30b1a27a373
Feed Name: Bleeping Computer
Threat Score
Koi Security uncovered the "Zoom Stealer" campaign — 18 browser extensions across Chrome, Firefox, and Edge that collect meeting URLs, IDs (including embedded passwords), participant details, and session metadata from 2.2 million users and stream the data via WebSockets to a threat actor tracked as DarkSpectre; the activity is linked to a larger 7.8 million-installation campaign and is assessed as China-linked based on hosting, language artifacts, timing, and monetization patterns.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.