Weaponised Google Meet Page Exploits ClickFix Technique

Du'aine Davis

Observed in the wild

• On 29 November, A malware campaign was discovered targeting remote workers and organisations via a fake Google Meet page hosted on gogl-meet[.]com. Victims are tricked into believing they need to fix a meeting error, leading to manual execution of a malicious script.
• The attack uses the ClickFix social engineering technique, instructing users to perform keystrokes (Windows key + R, CTRL + V, Enter) after copying a PowerShell script from the page. This bypasses browser security controls like Google Safe Browsing and SmartScreen, ultimately delivering a Remote Access Trojan (RAT). The script is obfuscated with Unicode symbols and comments to appear safe.
• Security teams should update detection rules in Microsoft Defender to flag PowerShell execution from the Run dialog containing unusual Unicode characters or excessive comments. Monitor for forensic indicators such as ADS entries in the Master File Table linking to gogl-meet[.]com. User awareness training on social engineering and restricting manual script execution is strongly recommended.

Beware of Weaponized Google Meet page that uses ClickFix to deliver Malicious Payload