09/05/2026
Subject: Real Estate Professional Member Alert — Fake Google Meet invite installing remote-access software on appraisers and agents machines.
A Northern Virginia appraiser was compromised on August 26, 2026 by a fake Google Meet invitation. The link installed remote-management software (ISL Online/SuperOps and ScreenConnect), giving an outside party control of the machine. Full Windows rebuild was required.
How it works: A "client" makes contact, exchanges several normal, well-written emails over a day or two to build trust, and proposes a video call. The link that arrives is not Google Meet.
Indicators from this case:
Sender: lambertdavid594@gmail[.]com ("David Lambert")
Link: hxxps://googlemeet[.]joinmeetinginvites[.]com/google-meet/
Subject line: "Re: Scheduling a time to connect"
Why filters missed it: SPF, DKIM, and DMARC all passed. It was sent from a real Gmail account through Google's own servers. Authentication proves the sender's domain, not their honesty.
Protect yourself:
A real Meet link is always meet.google.com/abc-defg-hij. Any other domain, or any path like /google-meet/, is fake.
You create the meeting. Send your own link. Never accept one from a new contact.
Never install anything at the request of a prospective client.
If you already clicked one: disconnect from the internet and get professional help immediately.
This is a national campaign. Realtor associations in Colorado, Pennsylvania, New Mexico, and Miami have issued similar alerts, and appraisers in Vermont and California report the same approach. Report to ic3.gov.