A crypto-stealing malware campaign named “Meeten” has been active since September 2024 and uses fake video conferencing platforms to infect both Windows and macOS operating systems. The threat actors target individuals working in the Web3 space under the guise of scheduling a business meeting, often reaching out via Telegram to discuss an investment opportunity. The victims are directed to join the meeting by downloading fake conferencing software, hosted on a website crafted to appear legitimate under product names such as “Meetone”, “Meetio”, “Clusee”, and “Cuesee”. The threat actors go so far as to populate social media accounts for the fake software with AI-generated content to trick victims into believing its legitimacy. There are two versions of the Realst payload developed to infect both Windows and macOS systems. The MacOS version of the malware is delivered through a backage named “CallCSSetup.pkg” which uses the command-line tool osascript to prompt the user to enter their password, escalating privileges. The malware collects Telegram and Keychain credentials, banking card details, Ledger and Trezor wallets, Browser cookies and autofill credentials which are stored locally in a zipped folder before exfiltration. The Windows version of Realst is deployed via an NSIS file named “MeetenApp.exe” and uses a stolen certificate. The Windows version can extract the same information from the victim system as its macOS counterpart but can also steal Phantom and Binance wallets and is able to persist between reboots. This campaign is particularly notable for its use of AI-generated content to quickly craft fake website content and garner a social media following. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.