ScanMalware.com
Known malicious kitcriticalphishing

Fake Zoom meeting: 'Your workspace is out of date' page delivering a remote-management agent

family: meetly-fake-meeting-update-2026-10
Short link:scanmalware.com/h/284

A fake video-meeting join page hosted in a cloud storage bucket. It shows the Zoom logo on a generic template whose own text calls the product 'Meetly'. The visitor is asked for an 11-digit meeting ID and a display name; after a short 'Joining meeting' spinner the page claims 'Sorry, your workspace is out of date' and its Update button downloads zoom-workspace.exe from a separate storage bucket. The file is a genuine, validly signed remote-management (RMM) agent installer that is pre-configured to enroll the computer into the operator's own account, which gives the operator remote control of the machine. Seen on zoom-meet-invite7845957.s3.us-east-1.amazonaws[.]com (uploaded 2026-10-12), with the installer at pub-9fad4cf58ddf41d6b8a66e8621858802.r2[.]dev.

Anchors

YARA ruleMeetly_Fake_Meeting_Update_Lure_Kit
SMQL queryrun
link_host:pub-9fad4cf58ddf41d6b8a66e8621858802.r2.dev OR domain:zoom-meet-invite7845957.s3.us-east-1.amazonaws.com OR link_host:zoom-meet-invite7845957.s3.us-east-1.amazonaws.com

Provenance

Added: 2026-10-14 06:06
One hunt for the kit. Search anchor: pages on the lure host, or pages linking to the lure or to the installer's storage bucket. Content anchor (a YARA rule): the kit's own structure, meaning the update screen's element ids, its update-check function and the 11-digit meeting-ID pattern, not Zoom branding or the 'Meetly' name, so genuine meeting platforms cannot match and a rebranded copy still does. Installer sha256 7ad81cd5580035c6e048d12a76a82b85b0f3278cedf9f55c6fceab171820cfd2 (each operator account gets a different file, so the hash identifies this copy only).
References:

Sightings (2)

HostScanScriptMatchWhen
zoom-meet-invite7845957.s3.us-east-1.amazonaws.combb5ac607…https://zoom-meet-invite7845957.s3.us-east-1.amazonaws.com/index.html#htmlyara2026-10-14 06:18
zoom-meet-invite7845957.s3.us-east-1.amazonaws.combb5ac607…—query2026-10-14 06:09