By Jackson Godwin. Cybersecurity Analyst & Penetration Tester
I Compared Both Emails
After the real meeting ended, I carefully compared the two invitations.
At first glance, they looked almost identical.
The same logo.
The same meeting subject.
The same company branding.
The same professional signature.
But when I looked closer, the differences became obvious.
The fraudulent email had come from an address that looked almost identical to my client’s—but one character had been changed.
It was enough to fool someone reading quickly.
The Fake Website Was Built to Look Perfect
I reopened the fake meeting link inside a secure test environment.
The page looked exactly like Zoom.
The colours matched.
The buttons matched.
Even the copyright notice looked authentic.
If someone landed on the page without checking the web address, they would probably believe it was genuine.
That was exactly what the attackers wanted.
The “Zoom Update” Wasn’t Zoom
The cybersecurity team later examined the downloaded file.
Despite its name—
Zoom_Update.exe
—it wasn’t an official Zoom update.
According to the investigators, the file was designed to install malware after the victim opened it.
Depending on the campaign, such malware could attempt to:
- Steal saved passwords.
- Capture browser cookies.
- Collect sensitive files.
- Install additional malicious software.
- Give attackers remote access to the computer.
The update wasn’t fixing Zoom.
It was opening the door to the attackers.
The Timing Was No Coincidence
One thing still bothered me.
How did the scammers know I actually had a meeting scheduled?
The investigators explained that cybercriminals don’t always need to know your calendar.
Many organisations hold online meetings every day.
By sending thousands of fake meeting invitations, attackers only need a small percentage of recipients to be expecting a meeting.
For those people, the fake invitation feels completely believable.
They Used Urgency as a Weapon
The fake email included several phrases designed to pressure me.
- Meeting starts in five minutes.
- Security update required immediately.
- Failure to update may prevent access.
Those messages weren’t technical instructions.
They were psychological pressure.
The attackers wanted me to act quickly instead of thinking carefully.
One Small Detail Saved Me
Looking back, two things prevented the attack.
First, I noticed the unusual web address.
Second—and even more importantly—the real client called before I downloaded the file.
If either of those things hadn’t happened, I might have installed malware myself.
Sometimes cybersecurity isn’t about advanced technology.
Sometimes it’s about noticing one small detail before it’s too late.
The Attack Could Have Spread Further
The investigators warned that if I had installed the fake update, the attackers might have tried to move beyond my own computer.
Compromised devices can sometimes be used to target business accounts, shared documents or additional victims.
One fake meeting invitation could have become a much larger security incident.
In the final part of this story, I’ll explain how fake meeting invitation scams work, reveal the warning signs everyone should recognise, and share practical ways to stay safe when joining online meetings.
Continue Reading: The Zoom Meeting That Was Actually a Cyber Attack (Part 3)