Fake Video Conferencing Apps Deliver Realst Malware Targeting Web3 Professionals

Cybersecurity researchers have identified a sophisticated scam campaign that uses fake video conferencing apps to distribute the Realst information stealer, primarily targeting professionals in the Web3 ecosystem.

The Scam Campaign: Meeten

This campaign, named Meeten by Cado Security, employs AI-generated fake companies and websites to lure victims into downloading malicious video conferencing applications under the pretense of business meetings.

How It Works:

1. Initial Contact: Victims are approached via Telegram with investment opportunities.
2. Redirection: They are asked to join a video call hosted on fraudulent platforms like Clusee, Cuesee, Meeten, Meetone, or Meetio.
3. Malware Delivery: Victims download a fake meeting application tailored to their operating system (Windows or macOS).

Targeted Platforms and Malware Capabilities

1. macOS Version:

1. Displays a compatibility error and prompts for the user's system password using osascript, a technique exploited by several macOS stealer families, including Atomic macOS Stealer and Cuckoo.
2. Data Stolen: Cryptocurrency wallets, iCloud Keychain data, Telegram credentials, banking information, and browser cookies.

2. Windows Version:

1. Distributed as an NSIS installer signed with a likely stolen digital signature.
2. Deploys a Rust-based stealer executable from an attacker-controlled domain.

Widespread Impacts

This campaign is not isolated; it shares similarities with prior incidents:

1. March 2024: A counterfeit site, meethub[.]gg, propagated stealer malware linked to Realst.
2. June 2024: The markopolo campaign targeted cryptocurrency users with fake virtual meeting software, delivering malware like Rhadamanthys and Atomic.

The ultimate goal is to exfiltrate sensitive data, drain cryptocurrency wallets, and compromise systems.

The Role of AI in Enhancing Scams

AI technology is being exploited to make these campaigns more convincing:

1. Realistic Content: Threat actors use AI to create legitimate-looking company profiles and websites.
2. Rapid Deployment: AI-generated assets reduce the time required to launch attacks, making them harder to detect.

Protecting Against Fake Video Conferencing Apps

To avoid falling victim to these scams:

1. Verify Sources: Always download applications from trusted platforms.
2. Enable Multi-Factor Authentication (MFA): Protect accounts with added security layers.
3. Educate Teams: Train employees to recognize phishing attempts and fraudulent business inquiries.
4. Use Security Tools: Employ endpoint protection to detect and mitigate malware.

The rise of fake video conferencing apps like Meeten is a stark reminder of the innovative methods cybercriminals use to exploit Web3 professionals. By leveraging AI and sophisticated social engineering tactics, they’re making these scams harder to detect. Vigilance and proactive cybersecurity measures are critical to safeguarding sensitive data and systems.