zoomapp[.]us

This domain, zoomapp.us, is identified as a credential theft operation designed to harvest login details by impersonating legitimate meeting services. The site presents a false 'Establishing Meeting' page, likely tricking users into entering sensitive information such as usernames, passwords, or even multi-factor authentication codes. Credential theft of this nature can lead to unauthorized access to corporate or personal accounts, data breaches, and further exploitation through lateral movement or identity fraud. Analysis indicates this domain was registered on May 4, 2026, through Cloudflare, Inc., a registrar frequently utilized for both legitimate and malicious infrastructure. The domain resolves to the IP address 177.7.58.202 and is hosted on Nginx web server technology. Detection metrics reveal significant concern among security vendors: 6 out of 95 engines on VirusTotal flag the domain as malicious, and it appears on four distinct security blocklists. Additionally, the domain has been assigned a trust score of 0 out of 100, further corroborating its malicious intent. If a user has visited zoomapp.us or entered any credentials on the site, immediate action is required. First, all passwords associated with the affected account should be changed, prioritizing accounts with elevated privileges or access to sensitive data. Enable multi-factor authentication if not already active. Monitor the account for unusual activity, such as unauthorized logins or changes to settings. Users should also scan their devices for malware, as credential theft sites may deploy additional payloads. Finally, report the incident to internal security teams or relevant authorities to assist in tracking and mitigating the threat.