By Jackson Godwin. Cybersecurity Analyst & Penetration Tester.
The Zoom Meeting That Was Actually a Cyber Attack
Disclaimer: This story is fictional but inspired by real phishing campaigns, fake video conferencing invitations and social engineering attacks targeting remote workers. It is written to educate readers about cybersecurity awareness and safe online practices.
It Looked Like an Important Client Meeting
It was Tuesday afternoon when I received an email.
The subject line read:
“Updated Zoom Meeting – Project Discussion (Urgent)”
The sender’s name belonged to someone I recognised.
A client I had spoken with a few weeks earlier.
The email explained that the meeting link had changed because of a scheduling issue.
Everything looked perfectly normal.
The Invitation Looked Genuine
The email contained:
- The Zoom logo.
- A meeting ID.
- A professional signature.
- The client’s company name.
- A blue button labelled:
“Join Zoom Meeting”
I checked the meeting time.
It matched my calendar.
Nothing seemed unusual.
I Joined Five Minutes Early
I clicked the meeting link.
Instead of opening Zoom immediately, a webpage appeared.
It looked almost identical to the official Zoom website.
A message appeared.
“Your Zoom client is outdated. Please install the latest security update before joining.”
Below the message was a large download button.
I Almost Downloaded the Update
The page explained that the meeting could not begin until I updated my Zoom application.
That sounded reasonable.
Software updates happen all the time.
The file waiting to be downloaded was named:
Zoom_Update.exe
I moved my cursor toward the download button.
Something Didn’t Feel Right
Just before clicking, I noticed the web address.
It wasn’t:
zoom.us
Instead, it contained a slightly different domain name that looked almost identical at first glance.
Only one letter was different.
Most people probably wouldn’t have noticed.
I nearly didn’t.
The Phone Call Changed Everything
While I was still looking at the page, my phone rang.
It was the real client.
He sounded confused.
“Are you joining the meeting?”
I replied:
“I’m updating Zoom first.”
There was silence.
Then he answered:
“Updating Zoom? We’re already waiting for you in the meeting.”
My heart sank.
I Closed Everything Immediately
Without downloading anything, I closed the browser.
Then I asked him to send the meeting invitation again.
The genuine invitation arrived seconds later.
This time, the meeting opened directly in the official Zoom application.
No update required.
No download.
No security warning.
That’s when I realised something terrifying.
The first email had never come from my client.
Someone had intercepted my trust—and nearly convinced me to install malware disguised as a Zoom update.
(Continue in Part 2, where I’ll explain how attackers impersonated my client, reveal what the fake Zoom update really contained, and show the warning signs that almost everyone misses.)