Web meetings:
When the attacker joins the call

The Arup case: probably the most expensive video call in the world

In early February 2024, Hong Kong police made public a case that has since become a textbook example. An employee in the finance department of a multinational company received an email, supposedly from the UK-based chief financial officer, about a confidential, 'secret' transaction. At first, the employee reacted exactly right: he suspected a phishing attempt.

But the fraudsters were prepared. They pulled him into a video conference where he saw and heard the CFO and several familiar colleagues. According to the police, every person he saw on that call was fake: the perpetrators had apparently used publicly available video and audio material in advance and turned it into convincing AI deepfakes. The apparent discussion among executives removed his remaining doubts. The employee made 15 transfers to five bank accounts in Hong Kong, a total of HK$200 million, or roughly US$25 million. The fraud only came to light when he later checked with the company's head office.

In May 2024, the British engineering and design firm Arup confirmed that it was the company involved. Arup stated that fake voices and images had been used and that none of its internal systems had been compromised. That is the real lesson: no system was hacked. What was hacked was one person's trust.

Why web meetings are so attractive to attackers

Deepfakes like the one at Arup are the tip of the iceberg. Most attacks via web meetings are much simpler, and that is exactly why they happen more often. There are several reasons for this.

First, attackers in a meeting can apply pressure in real time and adapt their tactics to the other person's reactions on the spot. Seeing the facial expressions and impatience of an apparent manager creates stress faster than an email does. Second, screen sharing makes it possible to guide a victim step by step: the attacker sees live which warning appears and immediately explains why it is safe to click it away.

Third, a face inspires trust. When we see and hear someone, our brain quickly switches to trust, so personal interaction does not make attackers more suspicious, it makes them more credible. The price for this: such an attack takes much more effort than a phishing email that reaches thousands of people with one click. That is why web meetings are used mainly where the effort pays off: in targeted attacks on finance departments, executives, IT, or HR.

Three everyday pretexts

In web meetings, social engineers usually rely on perfectly ordinary occasions. An apparent new customer shares documents in the chat that they want to discuss right away, and hides malware in them. A supposed HR department wants to 'reconcile employee data' and collects names, roles, and contact details for the next attack. A fake colleague from IT asks you to quickly install a piece of software to fix a problem, and gains full control of the computer.

The methods differ, but the goal is the same: confidential information, access, and ultimately money. To build trust, attackers pose as customers, suppliers, or job applicants, or they use hacked accounts of real colleagues. This is classic social engineering, just with a camera and screen sharing.

The danger starts before the meeting

The danger often begins before anyone has even joined the meeting. A typical scenario: a new contact writes via LinkedIn, you agree on a short call, and soon after an invitation arrives with an apparently normal Teams link. Anyone who clicks it lands on a page asking them to sign in with their Microsoft account. In reality, the page is fake and harvests credentials.

Tom's Guide showed in August 2025, citing Cloudflare, how professional such campaigns have become: using compromised accounts, attackers even abused the link-wrapping features of email security services to make their links look harmless. The lures included fake notifications styled like Microsoft Teams messages; the target was Microsoft 365 credentials.

A second trick relies on impatience. In February 2026, Malwarebytes described a fake Zoom page that simulates an ongoing meeting with participants and 'network problems'. After a few seconds, an alleged mandatory update appears with a countdown, and in the background a file is downloaded that installs a misused copy of the commercial monitoring software Teramind. Among other things, it can record keystrokes and screen content. Anyone rushing from one meeting to the next is quick to click through something like that.

When the risk comes from your own desk

Not every risk is an attack. Sometimes we are simply careless ourselves. An unknown guest sitting silently in the call may be a social engineer recording the entire meeting, including internal matters, strategies, and figures. An accidentally shared Outlook window is a classic: even subject lines can reveal project codes, sales figures, or the names of new customers.

Then there are the devices and objects in the room. Smart speakers wait for their wake word; if a word in the conversation sounds similar, the device can activate unintentionally and send fragments of the conversation to the cloud. And a whiteboard in the background is a problem even if it was only briefly in view: if the meeting is recorded, the video can later be paused and analysed at leisure.

Six rules for safe web meetings

What about security software?

Security software is an important building block: antivirus, email filters, and endpoint protection block much of the malware that arrives via attachments or fake updates. But it has limits. It cannot recognise a convincing conversation partner, it does not stop a payment that someone makes voluntarily, and legitimate remote support or monitoring tools cannot always be reliably distinguished from malicious use. That is why attackers in meetings deliberately play down warnings or try to get their victim to switch off protection themselves. The rule is simple: anyone who asks you to disable a security feature is a warning sign, not a helper.

What awareness teams should take from this

For CISOs and awareness managers, the most important lesson is this: web meetings are not a fringe IT topic but a central place of work, and therefore a central place of attack. Technical measures such as lobby settings, restrictions for external participants, or controlled software distribution are important. What matters most, however, is that employees know they are allowed to say no when the pressure is on.

This is not achieved through bans, but through clear processes and practice: mandatory call-back procedures for payment instructions, an unambiguous rule that IT never asks people to install software during a meeting, and executives who explicitly welcome verification instead of seeing it as distrust. People who have experienced manipulation first-hand recognise it more easily.

Our insight Experiencing manipulation live shows what manipulation feels like in a conversation. AI agents describes how voices can now be faked just like faces, and our insight on ransomware shows what happens once an attacker has gained access to a computer.

Conclusion

Web meetings feel familiar and harmless. That is exactly why they are an ideal entry point: a face creates trust, time pressure pushes doubts aside, and screen sharing opens doors that would otherwise stay closed. The Arup case shows how far this can go; the everyday cases show how often it happens.

The best protection is not new software, but an attitude: stay alert whenever something deviates from the usual, no matter who is on the screen.