Zoom Scam Red Flags: How Fake Calls Steal Logins and Crypto

A Zoom scam today is not just a fake meeting email; it is a social engineering attack that uses Zoom branding, real meeting systems, stolen chat accounts, fake video, or malicious update prompts to steal passwords, install malware, or take cryptocurrency. The single most important defense is to join meetings from the official Zoom app with a meeting ID or invite code you control, then stop immediately if anyone asks you to install an update, run a script, or paste a command during the call.

According to a Justice Department announcement and an FBI FLASH alert from Nov. 12, 2026, the FBI seized cloud infrastructure used by a North Korean social engineering scheme it calls FaceStealer. The FBI says FaceStealer stole more than $400 million in cryptocurrency in the last 18 months, and investigators seized more than 900 secretly recorded webcam videos of victims.

What is a Zoom scam?

A Zoom scam is any attack that abuses trust in Zoom meetings, Zoom branding, Zoom invitations, or video calls to make you click, sign in, download, or run something unsafe. Phishing, a trick that uses a fake message or page to steal logins or other sensitive information, is one common form. Malware, software designed to harm a device, spy on activity, or give an attacker access, is another common outcome.

The newest cases are more convincing because the meeting may appear to come from someone you know. In the FaceStealer scheme described by the FBI and DOJ on Nov. 12, 2026, attackers hijack a victim's Telegram or other chat account, then message that person's contacts with a meeting request that fits past conversations. The approach can also happen through LinkedIn, Slack, or Discord.

The attacker may send a Calendly or calendar invitation first. Shortly before the meeting, the attacker sends a link that looks like Zoom or Teams but points to a typo-squatted domain, meaning a look-alike web address designed to resemble a trusted service. The FBI gave examples including uu01webzoom.us and teams.livemeet.us. After a fake lobby, the site can play a previously recorded webcam video of the trusted contact, sometimes with several videos to simulate multiple participants.

Patrick Grandy, Assistant Director in Charge of the FBI Los Angeles Field Office, said FaceStealer is "capable of deceiving even the most experienced technical and security conscious computer user." That warning matters because the scam is not built only around bad spelling or obvious fake branding. It is built around timing, identity, and a familiar face. Our FaceStealer report covers the case in more detail.

How do the most common Zoom scams work?

The FaceStealer pattern starts with a trusted identity. After the fake meeting begins, the scammers claim there is an audio problem. They then guide the target to click an update prompt, run a script, or copy and paste code into the command line or Terminal. That step can install a browser cookie harvester, keylogger, screen capture tool, or backdoor.

The FBI says the webcam is recorded from the moment the fake link is clicked. That recording can then be used to target the new victim's own contacts, turning one compromised person into bait for the next. In several cases, cryptocurrency was stolen months to more than a year later, which means the visible meeting may be only the first step in a longer compromise.

The FBI also says the attackers have begun using AI deepfakes of well-known crypto people. A deepfake is synthetic audio or video created or altered by artificial intelligence to make a person appear to say or do something. In this scheme, however, the FBI says the attackers mostly rely on stolen real victim videos rather than fully synthetic clips.

Older Zoom scam patterns still matter. The University of Toronto phish example from April 2026 and BBB alerts describe fake messages such as "you missed a meeting" or "view invitation" that imitate Zoom branding and lead to a fake Zoom sign-in page or a download. Fake installer apps are another category to watch, as a fake Zoom app that slipped past Mac security showed, especially when a page or message pushes you to install a Zoom update from outside the official provider.

There is also a more subtle risk: a message can come from a real Zoom system and still be dangerous. The University of Wisconsin System information security advisory from June 8, 2026, warned that spammers can send invitations through Zoom itself, so the emails come from real Zoom addresses and may pass filters. The danger is the unexpected meeting, the organizer, the request inside the message, or the link that follows later.

Industry-specific lures are common too. The Colorado Association of Realtors alert from Feb. 18, 2026, said scammers posing as prospective home buyers asked agents to jump on a Zoom call and sent a link. Clicking could silently install malware or show a fake Zoom update prompt. In some cases, scammers tried to capture video for later deepfake impersonation. Keeping the Zoom app itself patched matters as well, since attackers also go after flaws in the software.

Which Zoom scam types should you know?

What are the red flags of a Zoom scam?

The strongest red flag is a process change at the last moment. If the calendar invite does not include a meeting link, and the link arrives shortly before the call from chat, treat that as suspicious. The FBI says scammers often leave the meeting link out of the calendar invite and send the fake link close to meeting time.

Another red flag is a request to fix audio by installing something, running a script, or pasting a command. Real Zoom updates do not require Terminal commands. Zoom's own security blog says Zoom Workplace should be downloaded or updated only from the Zoom web portal, inside the app itself, or an official marketplace such as the Apple App Store.

Email details still matter, but they are not enough. The Zoom Safety Center says official Zoom account emails can come from addresses such as no-reply@zoom.us, noreply-usernotification@zoom.us, or tns-no-reply@zoom.us. Zoom's Trust and Safety team will never ask for your password, credit card information, or other sensitive information by email, and you should never share a verification code.

If an email looks suspicious, Zoom says to type zoom.us into the browser yourself instead of clicking. For an unexpected "download the latest version" email, Zoom says to check the sender domain and hover over the link. If it does not go to an actual Zoom domain such as zoom.com or zoom.us, do not click.

How do you join a Zoom call safely?

1. Open the official Zoom app yourself instead of clicking a web link, especially for a new or infrequent contact.
2. Join with the meeting ID or invite code when possible, rather than trusting a late link in chat.
3. Check whether the original calendar invite actually includes the meeting link.
4. Confirm the meeting through another channel. If the invite came on Telegram, confirm by text message or phone.
5. Do not turn on your webcam until you can see, hear, and talk to the person who invited you.
6. If an update prompt appears during the call, leave the flow and update Zoom separately from the official app, Zoom web portal, or an official marketplace.
7. Never run scripts or paste code into Terminal or the command line because someone on a call asked you to.
8. Secure chat apps with multifactor authentication and login alerts, so a stolen account is less likely to reach your contacts unnoticed.
9. Keep only small amounts in browser extension wallets, and never store seed phrases or private keys on your devices.

A seed phrase is the secret recovery word list that can restore a cryptocurrency wallet. If someone obtains it, they may be able to move the wallet's assets. That is why the FBI advice is not only about Zoom hygiene, but also about reducing the damage if a device or browser wallet is compromised.

What should you do if you clicked a fake Zoom link?

• Disconnect from the suspicious flow and do not run any command, installer, or update prompt that appeared during the call.
• If cryptocurrency may be at risk, move funds to a new wallet with a new seed phrase on a clean device.
• Change passwords for affected accounts and any accounts reused on the same device or browser.
• Log out all active sessions where possible.
• Add multifactor authentication to chat, email, financial, and work accounts.
• Warn your contacts, because your recorded video or stolen chat account could be used against them next.
• Warn your employer if a work device, work account, or work contact list may be involved.
• Report the incident at IC3.gov. For the FaceStealer scheme, the FBI says to use the keyword FaceStealer.

Our take: The newest Zoom scams beat technical defenses by abusing trust in a familiar face or a real Zoom sender, so the reliable defense is process. You create or open the meeting yourself in the app, confirm out of band, and treat any "paste this command" or "install this update" request during a call as a hard stop. Real Zoom updates never require Terminal commands.

If a colleague you trust asked you during a call to paste a command into Terminal, would you do it? That hesitation is the point. The scam only needs the moment when a familiar face makes an unsafe step feel normal.