Meeten Malware Campaign Uses AI-Generated Branding to Target Web3 Users
Security researchers identified a sophisticated malware campaign using AI-generated branding and content to masquerade as legitimate video-calling software and steal cryptocurrency from Web3 users. The campaign, operating under names including Meeten and Meetio, used social engineering and fraudulent websites to distribute the Realst info stealer across macOS and Windows platforms.
What happened
Cado Security Labs discovered a campaign distributing the Realst crypto stealer malware under various company names including Meeten, Meetio, Clusee, Cuesee, Meetone, with both macOS and Windows variants active for approximately four months.
Threat actors used AI to generate website content, blogs, and product materials, and created social media accounts on Twitter and Medium to establish legitimacy for fake video-calling software.
Victims were contacted via Telegram with fraudulent business opportunities, directed to download malware from fake websites, with some receiving targeted investment presentations spoofing their own companies.
Reported impact
The malware steals cryptocurrency from victims' web browsers through embedded JavaScript on the website, even before installation, and through information stealing from compromised systems.
Users who installed the application had their passwords and cryptocurrency stolen after the malware prompted for credentials using macOS tools.
Index analysis
AI was used to generate branding and website content that mimicked legitimate software companies, enabling threat actors to present the fraudulent video-calling application as credible.
The campaign targeted Web3 professionals and cryptocurrency users through social engineering and impersonation tactics.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.