Russian Hackers Use Fake WebEx and Zoom to Spread Starland Malware

Michael Miller · 2026-07-16

A Russian hacking group known as UAT-11795 is targeting people by tricking them into downloading fake versions of popular video conferencing apps like WebEx and Zoom. Instead of getting the real software, victims end up installing a dangerous new backdoor called Starland RAT. This malware is designed to steal login credentials and cryptocurrency, putting both personal and business accounts at risk. ### How the Attack Works The attackers create websites that look almost identical to the official download pages for WebEx and Zoom. When someone searches for these apps online, they might click on a sponsored ad or a search result that leads to one of these fake sites. The download link on the fake site installs the trojanized version of the software instead of the real thing. Once installed, the fake app runs normally, so the user might not notice anything wrong. But in the background, Starland RAT silently begins its work. It can capture keystrokes, take screenshots, and even access saved passwords in browsers. This gives the hackers a direct line into the victim's digital life. ### Why This Matters for Professionals For anyone working in antidetect browsers or cybersecurity, this attack is a reminder that even trusted software can be weaponized. The use of video conferencing apps is particularly clever because so many people rely on them daily for work and personal calls. The attackers are exploiting that trust. - **Credential theft:** The malware targets saved passwords in browsers and password managers. - **Cryptocurrency theft:** It specifically looks for wallet files and exchange login details. - **Persistence:** Starland RAT can survive reboots and updates, making it hard to remove. ### How to Protect Yourself Staying safe from these kinds of attacks requires a mix of caution and good security habits. Here are a few practical steps you can take: - **Download software only from official sources.** Go directly to the company's website, not through search ads or third-party links. - **Check URLs carefully.** Fake sites often use slightly misspelled domain names or extra words in the URL. - **Use an antidetect browser.** These browsers can help mask your digital fingerprint, making it harder for attackers to track or target you specifically. - **Enable two-factor authentication.** Even if your password is stolen, 2FA can block access to your accounts. - **Keep your software updated.** Regular updates patch security holes that malware might exploit. ### The Bigger Picture This attack is part of a larger trend where financially motivated hackers use sophisticated methods to target individuals and businesses. The Russian group UAT-11795 is known for focusing on cryptocurrency theft, but their methods can easily be adapted for other types of data theft. > "The use of trojanized software is a classic but effective tactic because it preys on the trust users have in familiar brands." By staying informed and cautious, you can reduce your risk of falling victim to attacks like this. Remember, if something seems off about a download page or a software update, it's better to double-check than to risk your security.