Fake Zoom and Google Meet Scams Install Teramind: A Technical Deep Dive

Why It Matters

Abusing a legitimate commercial monitoring product lets attackers bypass many security controls, exposing enterprises to covert surveillance and data theft.

Key Takeaways

• Identical MSI used across Zoom and Google Meet scams
• Filename encodes attacker‑specific instance ID for configuration
• Hard‑coded C2 address rt.teramind.co validates installation
• Agent runs in hidden mode, no visible UI
• Two services mimic legitimate Windows processes for persistence

Pulse Analysis

The misuse of Teramind, a reputable employee‑monitoring solution, illustrates a growing trend where threat actors weaponize legitimate software to sidestep traditional malware detection. By wrapping malicious intent in a trusted vendor’s installer, attackers exploit the inherent trust placed in corporate‑approved tools, making it harder for endpoint solutions to flag the payload. This approach also reduces the need for custom code development, allowing rapid scaling across campaigns that impersonate popular collaboration platforms like Zoom and Google Meet.

Technically, the campaign’s clever use of the MSI filename as a configuration vector enables a single binary to serve countless attacker accounts. The custom .NET action extracts a 40‑character hex string, populating the TMINSTANCE property, while the hard‑coded router address rt.teramind.co acts as a pre‑flight gate. If the C2 endpoint is reachable, the installer proceeds, enabling hidden‑agent mode (TMSTEALTH=1) and deploying two services—tsvchst and pmon—that blend in with svchost.exe and Performance Monitor. The inclusion of built‑in SOCKS5 proxy support further obscures network traffic, complicating detection for security teams.

For defenders, the key is to treat legitimate‑software abuse as a distinct threat class. Monitoring for the unique ProgramData GUID directory, unexpected services, and the presence of Teramind driver files (tm_filter.sys, tmfsdrv2.sys) can provide early indicators. Application‑control policies that block MSI execution from browser download folders, combined with DNS filtering for rt.teramind.co, raise the barrier for successful deployment. As attackers continue to rebrand the installer under various innocuous names—Adobe Reader, file_agent, and more—the industry must adopt a proactive stance, integrating file‑hash whitelisting and behavioral analytics to catch these stealthy surveillance campaigns before they infiltrate corporate networks.