Fake Zoom and Google Meet scams install Teramind: A technical deep dive

Malwarebytes documents an expanding campaign that impersonates Zoom and Google Meet with fake Microsoft Store pages to deliver a single Teramind MSI configured for stealth surveillance via filename-parsed instance IDs, defaulting to router rt.teramind.co; the installer uses a connectivity gate, deploys stealth mode (TMSTEALTH=1), and persists via two services (tsvchst and pmon), with immediate C2 polling observed. The report contrasts infrastructures, catalogs observed instance IDs, provides IoCs (SHA-256 644ef9f5eea1d6a2bc39a62627ee3c7114a14e7050bafab8a76b9aa8069425fa; domains uswebzoomus.com and googlemeetinterview.click), and offers detection, prevention, and removal steps.