One click on this fake Google Meet update can give attackers control of your PC

A phishing page impersonating Google Meet leverages the Windows ms-device-enrollment deep link to silently enroll clicked devices into an attacker-controlled Esper MDM instance, giving the attacker full remote management (software install/removal, system settings, file access, lock/wipe) without deploying malware or stealing credentials. The report includes indicators (updatemeetmicro.online, tnrmuv-api.esper.cloud, Base64-encoded Esper blueprint and group IDs) and recommends checking Settings > Accounts > Access work or school for unknown enrollments, disconnecting suspicious entries, running anti-malware scans, and enforcing MDM enrollment restrictions.