Trojanized Installer Bundling Zoom with VelvetCake VBS Persistence

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•6

Detects trojanized versions of Zoom installers that bundle legitimate application installers alongside malicious components including a VBScript persistence mechanism (OneDriveUpdateScheduler) and the VelvetCake PowerShell downloader/C2 framework.