Fake Zoom lure domain delivering RMM MSI installer (AgtaBackup RAT chain)

Ankit Mehta@Secvyn

•updated 29 days ago•1•0•3

This rule detects HTTP GET requests to known malicious domains or URI patterns associated with fake video-conferencing lures. These lures redirect users to download RMM (Remote Monitoring and Management) MSI installers, often masquerading as legitimate software like Adobe Reader or video conferencing tools, as part of a social engineering campaign for initial access.