Google Meet clones, three stealers

Summary

Sekoia's research team followed a set of look-alike hosts that reproduce the joining screen of Google's video-conference service, down to an invented meeting code in the path. A dialog claims the microphone or headset has failed, and the repair button loads the clipboard. On Windows the pasted line calls mshta against a remote HTML Application; its obfuscated VBScript kills the parent process, pulls two executables over BITS, then reports success or failure together with the machine's public address. What lands is Stealc and Rhadamanthys, each wrapped by the HijackLoader crypter. Visitors identified as macOS receive a disk image instead, recognised as AMOS. Two Russian-speaking traffer crews, Slavic Nation Empire and Scamquerteo, sent victims to the same template, and a Telegram bot fed by the operators' backend counted every visit and download.

Overlap with other campaigns

We compared the 34 indicators in this record — covering 10 distinct registrable domains — against the 43 other published campaigns in this corpus.

• Phantom Meet fake download sites

  2026-08-07

  1 of the 34 indicators in Google Meet clones, three stealers also appear in this campaign.

  Shared registrable domains (2)

  • us18web-zoom[.]usdomain, shown defanged for safety: us18web-zoom dot us
  • webjoining[.]comdomain, shown defanged for safety: webjoining dot com

• AMOS via a shared delivery layer

  2026-08-07

  1 of the 34 indicators in Google Meet clones, three stealers also appear in this campaign.

  Shared registrable domain (1)

  • carolinejuskus[.]comdomain, shown defanged for safety: carolinejuskus dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

8 of 34

Checks recorded

16

Checks since publication

16

Never checked

26

Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 26 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

34 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.