AgtaBackup operator: fake Google Meet, Zoom and Google Drive update pages that install remote-access agents

Fake meeting and document pages run by the operator behind the AgtaBackup remote-access trojan. A copy of Google Meet blurs the meeting screen behind an "Update Google Meet" prompt; a Zoom "Join Meeting" page counts down and starts a download by itself; a Google Drive "scan warning" page offers a batch file presented as a PDF. Every download is a remote-management agent enrolled to the operator, such as a rebranded "Ops RMM" agent installed as "Google Meet" and hidden from the installed-programs list, TraceRMM, or a self-hosted ScreenConnect client. It gives the operator hands-on control of the computer, and the same operator's servers run the AgtaBackup RAT panel. The Meet and Drive pages report each visit and each download click to the operator through a tracker script, and a guard script disables the download button for automated browsers. Pages have run on domains such as 224meetgooglecomfskqcdzfcwh[.]com, get-googlemeet[.]com and us06webzoomus2fj2f830440905293[.]com, with payloads on random-name Netlify sites and a GitHub repository. A match means a page carrying the kit's tracker or guard, or a scan that touches one of its known lure, payload or server hosts, or the RAT panel.