PULSE NAME
One click on this fake Google Meet update can give attackers control of your PC
WHITE PetrP.73 2026-03-08 Modified: 2026-03-08
5
IOCs
LOW VOLUME
A recent threat involves a phishing campaign that masquerades as a Google Meet update, tricking users into unwittingly granting attackers control over their Windows computers. This technique employs a deceptive method that does not rely on traditional malware or credential theft mechanisms, making it particularly insidious. When users click on the link presented as an update, they are confronted with an "enrollment" prompt that is a legitimate Windows system dialog. As such, it effectively bypasses common security measures, such as browser warnings and email scanners typically designed to flag malicious actions.
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
Indicators of Compromise (5)
All domain email hostname
TYPEINDICATORDESCRIPTIONCREATED
domain esper.cloud 2026-03-08
domain sunlife-finance.com 2026-03-08
domain updatemeetmicro.online 2026-03-08
email collinsmckleen@sunlife-finance.com 2026-03-08
hostname tnrmuv-api.esper.cloud 2026-03-08