This behavior is seen even in business or enterprise environments, where Zoom installers are passed from employee to employee via WhatsApp Business.

They’re also passed along via WhatsApp, SHAREit or Verizon’s content transfer application. Zoom installers don’t just get downloaded via search. I happen to have a spare Zoom installer just lying around here somewhere Users who cannot access Google Play to download Zoom seem to resort to third-party markets such as aptoide. This is a global phenomenon, confirmed in North America, South America and Europe. As shown in the maps above, this behavior is not isolated to China, where sideloading is normal. This situation brings another important observation. Other custom downloader software usually have their own dedicated download folders, as do Google Chrome (/Android/data//files/Download/zoom.apk ) and UC Browser (/UCDownloads/zoom.apk). Android/data//files/Download/zoom.apkĪs expected, the vast majority of these binaries are generically saved to the Download folder. A simple query in our threat intelligence repository shows the following file paths and binary occurrences for official Zoom binaries. So, how can we know whether an APK is installed from a third-party or from a sanctioned market? The answer is simple: we look at the file paths of specific scanned binaries that have the fingerprints of known Zoom APK versions.

We can only extrapolate from this that people are confused as to where to download Zoom, so they resort to Google searches which might take them to third-party markets or other unofficial (read risky and questionable) distribution points. Europe third-party Zoom downloads for the past 3 weeks

Zoom cloud meeting google play