Zoom Stealer: A Threat to Corporate Data in North East India

In the digital age, cybersecurity is a critical concern for corporations worldwide, including those based in North East India. A recent discovery by researchers has unveiled a new threat called Zoom Stealer, which has affected over 2.2 million users across various browsers. This article delves into the implications of this campaign and its potential impact on businesses in the region.

The Threat Actor Behind Zoom Stealer

The Zoom Stealer campaign is one of several browser extension campaigns linked to a single threat actor known as DarkSpectre. This actor has been active for over seven years, reaching more than 7.8 million users. The China connection to DarkSpectre has been evident for some time, but recent discoveries have made the attribution clearer. Infrastructure such as hosting servers on Alibaba Cloud, ICP registrations, and code artifacts containing Chinese-language strings and comments all point towards a Chinese origin.

The Extensions and Their Purpose

The Zoom Stealer campaign uses 18 extensions to collect data related to corporate meetings. However, not all of these extensions are meeting-related. Some are used for downloading videos or as recording assistants, such as the Chrome Audio Capture extension with 800,000 installations. Despite their malicious intent, these extensions function as advertised, making them difficult to detect.

Data Collection and Exfiltration

The extensions request access to various video-conferencing platforms and collect data such as meeting URLs and IDs, registration status, topics, scheduled times, speaker and host information, company logos, graphics, and session metadata. This data is exfiltrated in real-time via WebSocket connections to the threat actors.

Implications for North East India and Beyond

The data collected by Zoom Stealer can be used for corporate espionage and sales intelligence. In the wrong hands, this information could be used for social engineering attacks or even to sell meeting links to competitors. This poses a significant risk to businesses in North East India and the broader Indian context, as sensitive corporate data could be compromised, leading to financial loss and damage to reputation.

Mitigation Strategies

Users are advised to review the permissions that their browser extensions require and limit them to the necessary minimum. Despite reports of the offending extensions, many are still present on the Chrome Web Store. It is crucial for users to stay vigilant and regularly check for updates and any suspicious activity.

Looking Forward

As the digital landscape continues to evolve, so too will the threats faced by businesses. It is essential for corporations to stay informed about the latest cybersecurity threats and implement robust strategies to protect their data. By doing so, they can safeguard their operations, maintain the trust of their clients, and ensure their long-term success.