Fake Zoom and Google Meet scams install Teramind: A technical deep dive

This report documents an active phishing campaign that lures victims to download a maliciously delivered Teramind MSI via fake Zoom and Google Meet update pages; the identical MSI is configured per-attacker by encoding an instance ID in the filename, contacts rt.teramind.co as a router/C2, installs stealthy persistent services and kernel drivers, and supports SOCKS5 proxying to obfuscate exfiltration. The authors provide file hashes, malicious domains, observed instance IDs, installation behavior from a live detonation, detection/mitigation guidance, and an uninstall procedure.