look mom HR application look mom no job The article describes a phishing attack where cybercriminals exploited Zoom's legitimate document-sharing feature to send fraudulent emails. Victims who clicked the link were redirected through a fake "bot protection" gate to a Gmail credential harvesting page, which exfiltrated login details in real-time via WebSocket to an attacker-controlled server. The attackers validated the stolen credentials on the backend to identify usable accounts. look mom HR application look mom no job https://blog.himanshuanand.com/2025/10/look-mom-hr-application-look-mom-no-job/ Table of Contents TLDR I have recieved a legit Zoom doc email from HR “while on job hunt” . It redirected to a site with a fake “bot protection” gate and then to a Gmail credential phish. The attackers exfiltrate creds live over WebSocket and even validate them in the backend. Keep reading for detailed analysis. look mom HR application look mom no job ⌗ look-mom-hr-application-look-mom-no-job Okay, this is kind of funny in a “please tell me this is not my life” way . I have been on the job hunt lately and an email landed in my inbox that I almost ignored. Only later did I realize: this one actually came from legit Zoom. Cool, right? Except not. Turns out bad people are now using Zoom’s legit features to phish people. Welcome to 2025, where your meeting app doubles as a cybercrime vector. what happened short, messy, and real ⌗ what-happened-short-messy-and-real - I got an email that looked like a normal Zoom doc/share notification. Header looked official. Sender looked legit. I almost clicked and moved on. Caption: Email header with valid SPF, DKIM and DMARC. - On deeper inspection I realized the document link led to an offsite page that redirected to a classic Gmail credential harvesting page. Caption: Zoom UI showing the shared document/link. - The attackers used Zoom’s document-sharing flow as the trusted vector. People trust Zoom, so they click. Caption: Screenshot of zoom website. - The phishing page had a “bot protection / phishing protection” gate that a user has to pass first. That is not to protect you - it is to protect the attackers from automated analysis and to make the page feel legitimate. Paste screenshot here: Caption: Fake bot protection gate that blocks sandboxes and looks legit. - One user entered their Gmail user ID and password. The phishing page immediately sent the credentials to a C2 using a WebSocket connection. Live exfiltration. Paste screenshot here: Caption: The Gmail credential harvest page. - I also captured a WebSocket snapshot showing the credentials being pushed out. Paste screenshot here: Caption: WebSocket connection showing live exfiltration. the chain of redirects I saw ⌗ the-chain-of-redirects-i-saw - initial link from Zoom UI: hxxps://overflow.qyrix . com.de/GAR@bBWe/ - this hosts the bot protection gate - once gate passed, redirected to: hxxps://overflow.qyrix . com.de/aoi99lxz7s0?id=02efd7fc7... - this is the Gmail phishing page Yes, the URLs are ugly and tell you everything you need to know. how their setup works ⌗ how-their-setup-works - Use a trusted platform Zoom to deliver the initial link. People click because it looks like a shared document. - Redirect to a “bot protection” gate. Two jobs: - keep automated analysis and sandboxes away, and - increase perceived legitimacy for the victim. - If the user passes the gate, show a credential harvest page that mimics Gmail login UI and asks for username and password. - On submit, open a WebSocket back to the attacker server and push the credentials in real time to C2. The server can validate them and mark hits. - They likely run a backend that validates credentials so they know which ones work. That is why the response felt slower than a static phishing page. Given the validation and the slower response times I observed, they are probably validating credentials in the backend. That means they are not just collecting creds, they are checking them for usability. neat but malicious tricks they used ⌗ neat-but-malicious-tricks-they-used - bot-protection gate - not to protect you, to protect them from analysis and to look legit. - real-time exfil via WebSocket - gives attackers immediate hits and lets them triage validated creds quickly. - using Zoom’s document flow as the social engineering vector - people trust Zoom notifications, so the click rate is higher. red flags to look for ⌗ red-flags-to-look-for - Email claims to come from Zoom, but the link domain does not match Zoom or Google. Always check the full link. - The page shows a “bot protection” widget or quiz before a login - that is suspicious in this context. < DOCTYPE html