On 29 April, Trend Micro reported a malicious campaign that used a booby-trapped installer for Zoom videoconferencing software to deliver the WebMonitor remote access trojan (RAT).1 WebMonitor is a RAT that can create and modify a victim’s files, record audio, log keystrokes, access webcams, view a streaming video of the victim’s screen, control system processes, and more.
Due to the ongoing Coronavirus pandemic, many organizations are relying on communication software to maintain their operations, and Zoom is one of the most popular videoconferencing options available.
While the report did not detail a specific distribution method, it did note that the malicious installer was not distributed through official sources such as Zoom’s website, the Apple App Store, or the Google Play Store.
Infoblox’s full report on this campaign will be available soon on our Threat Intelligence Reports page.
