Phantom Meet fake download sites

Summary

Sekoia grouped a large set of counterfeit download sites with the fake Google Meet pages it was tracking, on registration records, passive DNS, and page construction that repeats across the estate. The brands are borrowed or invented outright: video conferencing, document utilities, several games that do not exist, Web3 browsers and messengers, a metaverse client. Every page runs the same script — the visitor is told a check has failed, then walked through pasting a command. Windows visitors were sent Stealc or Rhadamanthys; macOS visitors were sent AMOS. Distribution ran through affiliate crews rather than one operator, which is why the naming conventions wander while the page templates do not. We hold this as a single estate because that is how the source groups it; the individual lure themes are tagged separately below.

Overlap with other campaigns

We compared the 124 indicators in this record — covering 124 distinct registrable domains — against the 43 other published campaigns in this corpus.

• Google Meet clones, three stealers

  2026-08-07

  1 of the 124 indicators in Phantom Meet fake download sites also appear in this campaign.

  Shared registrable domains (2)

  • us18web-zoom[.]usdomain, shown defanged for safety: us18web-zoom dot us
  • webjoining[.]comdomain, shown defanged for safety: webjoining dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

104 of 124

Checks recorded

208

Checks since publication

208

Never checked

20

Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 20 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Indicators

124 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.