From Outlook to Your Browser Cache: What ZoomInfo’s Plugin Is Really Collecting
A recent security analysis reveals that popular business software may be collecting far more employee data than organizations realize.
What Businesses Need to Know
Enterprise security isn't just about preventing ransomware attacks anymore. Modern threats include legitimate software that quietly harvests sensitive business data without clear disclosure.
ZoomInfoContactContributor.exe operates as an Outlook plugin that promises contact enrichment. However, Ostra Security's analysis uncovered extensive data collection activities that extend far beyond its stated purpose.
The software systematically captures email signatures, Global Address Lists, browser metadata, and local system information. This data feeds directly into ZoomInfo's commercial database - often without explicit organizational consent.
Risk Assessment Findings
Our sandbox analysis identified several concerning behaviors:
The application installs files in non-standard system directories. It establishes persistent connections to ZoomInfo-controlled servers. Process injection into Outlook occurs automatically, sometimes with startup persistence enabled.
Most troubling? The software accesses browser caches and autofill data - information typically considered sensitive in corporate environments.
These behaviors mirror patterns seen in information-stealing malware. The key difference: this comes wrapped in legitimate business software.
Technical Indicators for IT Teams
File System Artifacts:
- Primary executable: ZoomInfoContactContributor.exe
- Installation paths: %AppData%\Roaming\ZoomInfo\ContactContributor\ and %LocalAppData%\ZoomInfo\
Registry Modifications:
- HKCU\Software\ZoomInfo\ContactContributor
- HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ZoomInfoContactContributor
Network Communications:
- Outbound HTTPS to *.zoominfo.com domains
- Specific connections to contactcontributor.zoominfo.com
- Traffic spikes correlate with Outlook and browser usage
Process Behavior:
- OUTLOOK.EXE spawning ZoomInfoContactContributor.exe
- Registry Run keys for persistence
- Browser cache and autofill access patterns
Detection and Response
YARA Rule for Endpoint Detection
<same as above>
Sigma Rule for SIEM Integration
<same as above>
.png)
.png)
.png)