Fake Zoom Meeting Invitations: A New Phishing Technique

Malware installation. The phishing page displays a message: "This meeting requires the latest version of Zoom. Click here to update." The "update" is malware — typically an infostealer that captures passwords, browser cookies, and cryptocurrency wallets, or a remote access trojan that gives attackers persistent access to your computer.

Man-in-the-middle attacks. More sophisticated campaigns proxy the real Zoom login. You actually sign into Zoom through the attacker's server, which captures your session token. You join a real meeting (or see an error that the meeting ended), while the attacker now has an authenticated session to your Zoom account.

Red Flags to Watch For

You weren't expecting the meeting. If you receive a Zoom invitation for a meeting you don't remember being invited to, verify with the supposed host before clicking. This is especially important for invitations from people outside your organization.

The sender address is wrong. Real Zoom invitations come from no-reply@zoom.us. Phishing versions come from lookalike addresses like noreply@zoom-meetings.com or meeting@z00m.us (with zeros instead of o's).

The join link doesn't match. Hover over the link before clicking. The displayed text might show zoom.us/j/82341556789, but the actual URL (visible in the bottom-left corner of your browser) points elsewhere. This is the single most reliable way to detect the scam.

It asks you to download something. If you click a meeting link and are told to install or update Zoom, stop. Open Zoom separately from your Applications folder or Start menu. If an update is genuinely needed, Zoom will prompt you to update through the app itself, not through a browser page.

It asks for credentials you shouldn't need. If you're already signed into Zoom and a meeting link asks you to sign in again, something is wrong. Real Zoom links open directly in the app or launch the web client using your existing session.

How to Safely Join Zoom Meetings

Instead of clicking links in emails, copy the Meeting ID and paste it into the Zoom app directly. Open Zoom, click "Join," enter the Meeting ID and passcode, and join from there. This bypasses any phishing links entirely.

If you use a calendar integration (Google Calendar, Outlook), joining through the calendar event is safer than clicking email links, because the calendar event was typically created by the real Zoom scheduling system.

For organizations, configure Zoom SSO so that authentication happens only through your identity provider. This means even if an employee clicks a phishing link and sees a fake Zoom login page, they'll recognize it's not the usual SSO login flow.

After Clicking a Suspicious Link

If you entered your Zoom credentials on a suspicious page, change your Zoom password immediately at zoom.us/profile. If you use the same password elsewhere, change those too. Enable two-factor authentication on your Zoom account. If you downloaded anything, disconnect from the network and run a full malware scan. Notify your IT team if this is a work account — the attacker may have already accessed meeting recordings, chat logs, or contact lists.

Meeting invitations are part of daily work life, and that's exactly why they make such effective phishing lures. Build the habit of verifying links before clicking, and join meetings through the app rather than through email links.