Zoom Doom: Chinese Hackers Steal 2.2M Video Meeting Secrets Through Fake Browser Extensions

This is your Digital Frontline: Daily China Cyber Intel podcast. Hey listeners, I'm Ting, and welcome back to Digital Frontline: Daily China Cyber Intel. Let's jump straight into what's happening in the cyber trenches right now. China's cyber operations are hitting overdrive as we kick off 2026. A major threat just surfaced through what security researchers at Koi Security are calling the Zoom Stealer campaign. This one's nasty. A China-linked threat actor group called DarkSpectre has compromised 2.2 million users through eighteen malicious browser extensions targeting Chrome, Firefox, and Microsoft Edge. They're not just stealing random data either. These extensions are harvesting sensitive meeting information like URLs, participant IDs, topics, descriptions, and embedded passwords from video conferencing platforms. We're talking about targeting twenty-eight different conferencing systems here. The data exfiltration happens through WebSocket connections, making it harder to detect. DarkSpectre's fingerprints are all over this with Chinese infrastructure registrations and code containing Chinese-language elements. Their endgame? Corporate espionage, social engineering attacks, and selling those meeting links to competitors who'd pay top dollar. But that's just the opening act. According to Ankura's threat intelligence team, this campaign is part of a much larger pattern. DarkSpectre has been operating for seven years, compromising over 7.8 million users through previous operations like GhostPoster and ShadyPanda. They're getting bolder and more sophisticated. Meanwhile, the U.S. Cybersecurity and Infrastructure Security Agency and the FBI have been warning about vulnerabilities that attackers keep exploiting in the wild, and ransomware gangs are absolutely weaponizing these gaps. Shadowserver's telemetry shows over 1,300 vulnerable devices in the United States alone right now. Here's what you need to do immediately. First, audit your browser extensions. Get rid of anything you don't absolutely need, especially from untrusted sources. Second, enable multi-factor authentication on every video conferencing platform your organization uses. Third, assume that meeting links and details shared over standard channels might be compromised. Use encrypted channels instead. Fourth, monitor your network for suspicious WebSocket connections, particularly to external IP addresses during off-hours. Organizations need to treat this as a critical incident response priority. If you're in finance, healthcare, tech, or government, you're on DarkSpectre's radar. Segment your networks so that even if someone gains access through a compromised extension, they can't immediately pivot to your crown jewels. Thanks for tuning in to Digital Frontline, listeners. Make sure to subscribe for your daily China cyber intelligence briefing. This has been a Quiet Please production. For more, check out quietplease dot ai. For more http://www.quietplease.ai Get the best deal This content was created in partnership and with the help of Artificial Intelligence AI.