The FBI and US Department of Justice noted that attackers used compromised accounts on Telegram, LinkedIn, Slack and Discord to contact potential victims. Hackers directed targets toward counterfeit Zoom, Microsoft Teams and Google Meet websites, where prerecorded videos of familiar contacts created convincing meetings.
Victims then encountered fabricated audio problems and instructions to install supposed fixes. Instead, these actions downloaded malware capable of recording keystrokes, capturing screens and accessing sensitive information. Attackers also secretly recorded victims' webcams, using the footage to impersonate them during subsequent attacks.
