The Zoom Stealer campaign, uncovered by Koi Security, affects 2.2 million users across Chrome, Firefox, and Microsoft Edge through eighteen (18) extensions that collect data related to online meetings, such as URLs, IDs, topics, descriptions, and embedded passwords. This campaign is attributed to the China-linked threat actor DarkSpectre, which has targeted over 7.8 million users over seven (7) years through other campaigns like GhostPoster and ShadyPanda. DarkSpectre’s activities are linked to Chinese infrastructure, with evidence including ICP registrations, and code artifacts featuring Chinese-language elements. The campaign targets twenty-eight (28) video-conferencing platforms, collecting extensive meeting data that is exfiltrated via WebSocket connections. This data can be leveraged for corporate espionage, social engineering attacks, or selling meeting links to competitors. The extensions, including Chrome Audio Capture and Twitter X Video Downloader, are functional and remain on the Chrome Web Store despite being reported. DarkSpectre’s systematic collection of meeting data allows for potential large-scale impersonation operations, posing significant security threats. CTIX Analysts recommend users review extension permissions carefully and limit their use to minimize risks.