RATs Distributed Through Skype, Zoom, & Google Meet Lures

This report details a multi-platform malware campaign that hosts Russian-language fake Skype, Google Meet, and Zoom sites on a shared IP to trick users into downloading malicious Android APKs (SpyNote RAT) or Windows BAT installers that retrieve and execute DCRat payloads. The attackers used domains and URL paths crafted to resemble legitimate meeting links, delivered payloads via Google Play/Windows buttons, and packed the final Windows RAT with Eziriz.NET Reactor, demonstrating active distribution of remote-access trojans through social-engineered meeting site impersonation.