Security

Web3 workers are being targeted by a campaign that uses fake meeting apps to inject malware and steal credentials to websites, apps and crypto wallets, Cado Security Labs warned.
Scammers are using artificial intelligence to generate and fill out websites and social media accounts to appear as legitimate companies before contacting potential targets to prompt them to download a meeting app, Cado’s threat research lead Tara Gould wrote in a Dec. 6 <a data-ct-non-breakable="null" href="https://www.cadosecurity.com/blog/meeten-malware-threat" rel="null" target="null" text="null" title="null">report</a>.
The app is called “Meeten” but it’s currently going by the name “Meetio” and regularly changes names. In the past, it has used Clusee.com, Cuesee, Meeten.gg, Meeten.us and Meetone.gg.
The app contains a Realst info stealer and, once downloaded, will hunt for sensitive items such as Telegram logins, banking card details and information on crypto wallets to send back to the attackers.
<figure>
 <img alt="Security, Malware, Hackers, Cybercrime, Cybersecurity, Web3" src="https://s3.cointelegraph.com/uploads/2024-12/0193a9fb-1af6-74d2-a856-0094abbd1274" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/CadoSecurity/status/1865026404762460318" rel="null" target="null" text="null" title="null">Cado Security Labs</a>&nbsp;
 </figcaption>
</figure>
The stealer can also search for browser cookies and autofill credentials from applications like Google Chrome and Mircosoft Edge, along with info on <a data-ct-non-breakable="null" href="https://cointelegraph.com/explained/crypto-wallets-explained" rel="null" target="null" text="null" title="null">Ledger, Trezor and Binance Wallets</a>.
The scheme can involve <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-hackers-expand-social-engineering-operation-it-firms" rel="null" target="null" text="null" title="null">social engineering</a> and spoofing. One user reported being contacted on Telegram by someone they knew who wanted to discuss a business opportunity but was later outed as an impersonator.
“Even more interestingly, the scammer sent an investment presentation from the target’s company to him, indicating a sophisticated and targeted scam,” Gould said.&nbsp;&nbsp;
Others have reported “being on calls related to Web3 work, downloading the software and having their cryptocurrency stolen,” Gould added.
<figure>
 <img alt="Security, Malware, Hackers, Cybercrime, Cybersecurity, Web3" src="https://s3.cointelegraph.com/uploads/2024-12/0193a9fb-91ce-787b-821f-f097524738e7" title="">
 <figcaption style="text-align: center;">
 The fake meeting app cycles through names alongside a site filled with AI-generated content to appear more legitimate. Source: <a data-ct-non-breakable="null" href="https://www.cadosecurity.com/blog/meeten-malware-threat" rel="null" target="null" text="null" title="null">Cado Security Labs</a>
 </figcaption>
</figure>
To help gain credibility, the scammers set up a company <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/how-ai-and-deepfakes-are-fueling-new-cryptocurrency-scams" rel="null" target="null" text="null" title="null">website with AI-generated</a> blogs, product content and accompanying social media accounts, including X and Medium.
“While much of the recent focus has been on the potential of AI to create malware, threat actors are increasingly using AI to generate content for their campaigns,” Gould said.
“Using AI enables threat actors to quickly create realistic website content that adds legitimacy to their scams and makes it more difficult to detect suspicious websites.”&nbsp;
The fake websites where users are prompted to download the malware-riddled software also contain Javascript to steal crypto stored in web browsers, even before installing any malware. Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-phishing-scams-rise-holidays-9-3-m-nov-cyvers" rel="null" target="null" text="null" title="null">Crypto phishing scams to rise during holiday shopping season — Cyvers</a>
The scammers have created both a macOS and Windows variant. Gould says the scheme has been active for about four months. Other scammers have also been actively using these tactics. In August, onchain sleuth ZackXBT said he <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/zachxbt-claims-21-north-korea-crypto-devs-making-500k-month" rel="null" target="null" text="null" title="null">found 21 developers</a>, probably North Koreans, working on various crypto projects involving fake identities.
In September, the FBI <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/fbi-warning-north-korea-scheme-steal-cryptocurrency" rel="null" target="null" text="null" title="null">issued a warning about North Korean hackers</a> targeting crypto companies and <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/defi-a-comprehensive-guide-to-decentralized-finance" rel="null" target="null" text="null" title="null">decentralized finance</a> projects with malware disguised as employment offers.&nbsp;
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/bitcoin-price-100k-donald-trump-paul-atkins-sec-gary-gensler-hodlers-digest/" rel="null" target="null" text="null" title="null">BTC hits $100K, Trump taps Paul Atkins for SEC chair, and more: Hodler’s&nbsp; Digest, Dec. 1 – 7</a>

Crypto-stealing scam targets Web3 workers with fake meeting apps

Cointelegraph

Other articles published on Dec 9, 2024

Justin Sun Moves $119M ETH as Price Hits $4K

XRP Price Drops 5%: Key Support and Bearish Trends Explained

Former US Treasury Secretary Makes Shocking Remarks About Trump’s Bitcoin Plans

Cheelee (CHEEL) leads token unlocks worth $1.347 billion this week

DPRK-linked hackers social engineered $50m Radiant Capital exploit: report

WSPN Partners with Fractal to Expand Stablecoin Access on Bitcoin

Join our free newsletter for daily crypto updates!