WatchOut #6 · Confirmed
Fake Zoom invite pushes a Microsoft Store lookalike and suspicious installer
Email Website Other ImpersonationTechnology & workplace scams
Who may be targeted: People who receive unexpected Zoom meeting invitations or are asked to install a meeting update.
What we are seeing
A page hosted in an Amazon S3 bucket presents a fake Zoom meeting invitation. It imitates a Microsoft Store listing for Zoom Workplace, claims that an update or plug-in is required, and starts a download. The download points to a ScreenConnect client installer hosted on a separate domain. Treat the installer as unsafe and do not open it.
Warning signs
- The meeting page is hosted on an unrelated Amazon S3 address instead of an official Zoom domain.
- The page imitates the Microsoft Store while presenting a Zoom listing.
- It says a plug-in or update is required before joining the meeting.
- The download points to a ScreenConnect installer on an unrelated domain.
- A browser message says the download has started and tells you to open the installer.
Reported addresses
Written so they cannot be clicked. Do not retype them into your browser.
zoom-meet-us997234[.]s3[.]us-east-2[.]amazonaws[.]compivotalequipmentllc2[.]screenconnect[.]com
Source and limitations — what this alert does not establish
- The landing page was reviewed without executing the downloaded installer.
- The page content observed shows a fake Microsoft Store presentation and a download-started message; this record does not claim independent malware analysis of the MSI file.
- The hosting and download URLs may change or stop responding.
First observed Aug 22, 2026. Published Aug 22, 2026. Published by the Cybersecurity Reach Foundation.
Send this to someone it could protect.