Cybercriminals have launched an advanced campaign targeting Web3 professionals by distributing fake video conferencing software. The malware, known as Meeten, infects both Windows and macOS systems, stealing sensitive data, including cryptocurrency, banking details, browser-stored information, and Keychain credentials. Active since September 2024, Meeten masquerades as legitimate software while compromising users' systems.
The campaign, uncovered by Cado Security Labs, represents an evolving strategy among threat actors. Frequently rebranded to appear authentic, fake meeting platforms have been renamed as Clusee, Cuesee, and Meetone. These platforms are supported by highly convincing websites and AI-generated social media profiles.
How Victims Are Targeted:
- Phishing schemes and social engineering tactics are the primary methods.
- Attackers impersonate trusted contacts on platforms like Telegram.
- Victims are directed to download the fraudulent Meeten app, often accompanied by fake company-specific presentations.
Key behaviors include:
- Escalates privileges by prompting users for their system password via legitimate macOS tools.
- Displays a decoy error message while stealing sensitive data in the background.
- Collects and exfiltrates data such as Telegram credentials, banking details, Keychain data, and browser-stored information.
The stolen data is compressed and sent to remote servers, giving attackers access to victims’ sensitive information.
Technical Details: Malware Behavior on Windows
On Windows, the malware is delivered as an NSIS file named MeetenApp.exe, featuring a stolen digital certificate for added legitimacy. Key behaviors include:
- Employs an Electron app to connect to remote servers and download additional malware payloads.
- Steals system information, browser data, and cryptocurrency wallet credentials, targeting hardware wallets like Ledger and Trezor.
- Achieves persistence by modifying the Windows registry.
Impact on Web3 Professionals
Web3 professionals are particularly vulnerable as the malware leverages social engineering tactics to exploit trust. By targeting those engaged in cryptocurrency and blockchain technologies, attackers aim to gain access to valuable digital assets.
Protective Measures:
- Verify Software Legitimacy: Always confirm the authenticity of downloaded software.
- Use Malware Scanning Tools: Scan files with services like VirusTotal before installation.
- Avoid Untrusted Sources: Download software only from verified sources.
- Stay Vigilant: Be cautious of unsolicited meeting invitations or unexpected file-sharing requests.
As social engineering tactics grow increasingly sophisticated, vigilance and proactive security measures are critical in safeguarding sensitive data and cryptocurrency assets. The Meeten campaign underscores the importance of staying informed and adopting robust cybersecurity practices in the Web3 landscape.
