A fake Zoom meeting page looks real, triggers a bogus “update,” and silently installs surveillance software.