I'm sure there are other reasons, but three understandable reasons I've seen: 1) The lack of e2e encryption despite trying to market themselves as having secure video chat. 2) news.ycombinator.com/item?id=22749805 (comment in this thread - they literally phish you) 3) twitter.com/c1truz_/status/124473767293… abusing the traditional installation process on OSX EDIT: OK (2) may be a real system prompt - twitter.com/DigitalResist0r/status/1245…...? I didn't see anyone else in the twitter thread claim that it was using a real system dialog, so I'd still say it was poor practice of them to have such a shady looking system dialog.

Not to mention said company have previously been caught installing malware on people’s computer[1], lied about encryption[2], censored US citizens on behalf of Beijing[3] just to name a few incidents. And to make matters worse, 99+% of the Zoom meetings could easily take place on Jitsi Meet, Teams, etc. [1]: mobile.twitter.com/c1truz_/status/12447…... [2]: theintercept.com/2020/03/31/zoom-meetin… [3]: arstechnica.com/tech-policy/2020/06/zoo…...

My first introduction to Zoom was their malware-like pre-install install. twitter.com/c1truz_/status/124473767293…

There's also a very easy attack vector with pkg installs where an installer can "run software to ensure it's compatible with this machine" that's been there since forever. Not sure if it was removed in Big Sur or not but I hope so. Zoom used that hole to gain admin permissions and install itself before the user even completed the installation process if the user was admin[1] (and we know most people use admin accounts as their main ones). I'm sure plenty of other malware has done this as well. If this was simply delivered as a trojan with one of those fake "Flash Player needs updating" type popups, it could have very well abused that. If it's installing without user interaction the attack vector is a far more advanced 0day exploit chain. I'll be very interested to find out. I am also curious about how they can get away with using AWS and Akamai as C&C. Surely now this malware has been found, those providers will just shut down the accounts being used? They'll also have some kind of trail towards whoever's behind it, it's not like AWS takes payment in crypto. [1] twitter.com/c1truz_/status/124473767293…

Zoom doesn't have a great track record here. In the past [1] they'd "(ab)use preinstallation scripts, manually unpack the app using a bundled 7zip and install it to /Applications if the current user is in the admin group (no root needed)." [1] twitter.com/c1truz_/status/124473767293…

They also have a track record of being malicious twitter.com/c1truz_/status/124473767293…

More details from @c1truz_ on Twitter: twitter.com/c1truz_/status/124473767293…

It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: twitter.com/c1truz_/status/124473767519…... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what it does.

Incorrect. Look at the second tweet in the thread. It's a phishing popup that misidentifies itself in order to steal priveleges intended for System, not Zoom. mobile.twitter.com/c1truz_/status/12447…...

I moved away early this year due to its poor track record on security: 2019 - Report of the Zoom app's malware like behaviour-using a hidden web server to enable Zoom much more capabilities than simply launching a zoom call like re-installing the Zoom software[1] 2020-Tricking its users during installation pretending the OS is requiring password[2] In general, playing fast and loose with its users' data-sending a conference en(de)cryption key between two users in Canada/US to an ip address in Beijing.[3] [1]medium.com/bugbountywriteup/zoom-zero-d…... [2]twitter.com/c1truz_/status/124473767293… [3]citizenlab.ca/2020/04/move-fast-roll-yo…...