Zoom and GitHub Phishing Attacks: How to Recognize, Prevent, and Respond

Phishing attacks targeting widely-used platforms such as Zoom and GitHub have significantly escalated, creating substantial cybersecurity threats for individuals and organizations alike.

In recent incidents involving Zoom phishing and GitHub phishing, attackers employed strategies that combine social engineering, credential theft, and malicious software deployment, posing risks of severe financial loss, operational disruption, and lasting reputational damage.

GitHub Phishing: A Deep Dive

Let's first examine how users fell victim to GitHub phishing attacks through deceptive emails impersonating CircleCI, a tool widely integrated with GitHub. These emails were meticulously crafted, exploiting trust and urgency to bypass the recipient’s suspicion.

Fake Alert: The Hook

Victims received emails alerting them, "Your CircleCI session has expired. Log in again with your GitHub credentials immediately." These emails leveraged urgency and familiarity, pressuring users into quick action without scrutiny.

Deceptive Redirects

Upon clicking the provided link, users were directed not to GitHub’s genuine login portal but a strikingly similar phishing site. From layout to branding, attackers cloned GitHub’s page with uncanny precision.

Credential Harvesting

When users input their GitHub login details into the fake portal, attackers silently captured their credentials. Even more troubling, the phishing page anticipated two-factor authentication (2FA), prompting victims to input verification codes sent to their devices. Victims believed they were fortifying their accounts; instead, they handed attackers full access.

Fortunately, users relying on physical security keys avoided compromise, demonstrating the effectiveness of hardware-based authentication in thwarting phishing attempts.

GitHub’s Swift Response

GitHub quickly responded upon detecting these phishing attempts, invalidating stolen credentials and mandating immediate password resets for affected users. The attackers’ accounts were swiftly suspended, demonstrating GitHub’s vigilance and proactive stance.

GitHub urged all users to reset passwords, regenerate two-factor recovery codes, and review their personal access tokens. Such steps highlight the importance of regularly auditing your digital security footprint, a best practice I've consistently emphasized over my career.

Zoom Phishing: The FIN11 Threat Actor

Zoom phishing schemes have similarly leveraged the platform's widespread adoption, particularly intensified by the remote work surge during the COVID-19 pandemic. FIN11, a notorious threat group with a track record in sophisticated phishing operations, orchestrated an elaborate campaign exploiting Zoom’s global popularity.

Exploitation of Trust

FIN11 carefully crafted emails posing as official Zoom communications, offering fake software updates promising enhanced security and improved features. These emails featured professional logos and convincing language, indistinguishable from genuine Zoom correspondence at first glance.

Malicious Downloads

Upon interacting with links in these emails, victims were redirected to fraudulent websites meticulously cloned to mimic Zoom’s official page. Here, users were prompted to download a supposed updated version of the Zoom application. Tragically, these downloads contained malicious executables.

The downloaded file, deceptively named "Zoom.exe," was malware designed to infiltrate and compromise user systems upon execution.

Malicious Execution and Compromise

Running "Zoom.exe" secretly installed additional malware, such as "Decoder.exe," creating a stealthy entry point into the compromised system. Subsequently, "MSBuild.exe" was deployed, covertly downloading malicious DLL files linked to the notorious "Vidar" information-stealing malware. Vidar extracts sensitive information, such as passwords, financial data, and personal details, sending them directly to attackers.

This attack chain exemplifies how initial phishing attempts can rapidly escalate into deep system breaches, highlighting the critical importance of vigilance and verification in online interactions.

How the FIN11 Threat Works

The FIN11 threat is all about tricking people by using fake updates for apps we use every day, like Zoom. This group is really good at making their fake messages and websites look real, which is how they sneak harmful software onto computers. Next, we're going to look closely at the "Technical Details" section to understand exactly how FIN11 pulls off their tricks.

This part is important because it shows us, step by step, what happens from the moment someone clicks on a bad link to when the unwanted software gets installed. Knowing this can help us be more careful and keep our computers safe.

Technical Details

Let's explore deeper into the mechanics of the FIN11 attack with examples to understand how this threat unfolds:

• Initial Contact: The attack begins with an email that closely mimics a legitimate communication from Zoom, complete with logos and language that would not look out of place in an official message. This email prompts you to download a new version of Zoom for the latest features and security updates.
• Phishing Link: The email contains a link that, while appearing to direct you to Zoom's official website, actually leads to a skillfully crafted imitation designed to deceive the user into thinking they're on the real site.
• Malicious Download: On this phishing site, the user is encouraged to download the supposed new version of Zoom. However, the downloaded file, named “Zoom.exe,” is malicious software disguised as a legitimate application.
• Execution of Malicious File: Upon running “Zoom.exe,” it secretly installs a secondary program, “Decoder.exe,” onto the user's computer without their knowledge. “Decoder.exe” is essentially a gateway for the attacker, enabling the download and installation of additional malicious payloads.
• Additional Malicious Payloads: After the fake Zoom app is on your computer, the bad app puts in "MSBuild.exe," a sneaky tool that helps bring in more harmful files called "DLLs." These DLLs are connected to "Vidar," a tool that steals info like passwords and bank details from your computer and sends it to hackers.
• Importance of Vigilance: This example highlights the critical importance of verifying the source of software downloads. Always ensure you are downloading apps directly from the official website or a trusted app store. Pay close attention to the URL of the website you are downloading from; it should match exactly the official URL of the service.

Cybersecurity Best Practices to Mitigate Zoom and GitHub Phishing

Having faced countless such threats, I've consistently advocated comprehensive security awareness training and multi-layered defense strategies. To mitigate risks from Zoom phishing and GitHub phishing, organizations should adopt robust measures:

• Educate Employees: Regular training sessions highlighting how to recognize phishing emails, scrutinize URLs carefully, and verify downloads from official websites.
• Implement Multi-Factor Authentication (MFA): Prioritize hardware-based security keys and authenticator apps rather than SMS-based methods vulnerable to SIM-swapping attacks.
• Regularly Update Security Protocols: Consistently update cybersecurity policies and ensure timely patches and security updates for all software used across the organization.
• Monitor and Respond Swiftly: Employ continuous monitoring for suspicious activities and implement incident response plans to swiftly address and neutralize threats.

Read our guide to learn latest phishing statistics for further information.

How Can Keepnet’s Help From Phishing Attacks

Use our Phishing Simulator to protect your organization against social engineering attacks. Phishing tests are designed to allow employees to detect phishing attacks and their variants and report them appropriately. They are also used to detect weak links and measure the effectiveness of security awareness training programs. The Phishing Simulation module is fully-integrated with our Security awareness training to automatically place employees who are caught by our phishing simulations onto appropriate e-learning courses to improve their vigilance to genuine phishing attacks.

Phishing Simulation focuses on problems that many industries have been facing today, and we provide a detailed report of how your system is secured by Keepnet Labs security awareness modules.

Watch Keepnet human risk management platform solutions and see how Keepnet can protect your organization againts varios social engineering attacks.

Editor's Note: This blog was updated on 12 Jun, 2025.