Ankura CTIX FLASH Update - December 10, 2024

Malware Activity

Fake Video Conferencing Apps Spread Crypto-Stealing Malware

A crypto-stealing malware campaign named "Meeten" has been active since September 2024 and uses fake video conferencing platforms to infect both Windows and macOS operating systems. The threat actors target individuals working in the Web3 space under the guise of scheduling a business meeting, often reaching out via Telegram to discuss an investment opportunity. The victims are directed to join the meeting by downloading fake conferencing software, hosted on a website crafted to appear legitimate under product names such as "Meetone", "Meetio", "Clusee", and "Cuesee". The threat actors go so far as to populate social media accounts for the fake software with AI-generated content to trick victims into believing its legitimacy. There are two versions of the Realst payload developed to infect both Windows and macOS systems. The MacOS version of the malware is delivered through a backage