Fake meeting or conferencing app

Sekoia grouped a large set of counterfeit download sites with the fake Google Meet pages it was tracking, on registration records, passive DNS, and page construction that repeats across the estate. The brands are borrowed or invented outright: video conferencing, document utilities, several games that do not exist, Web3 browsers and messengers, a metaverse client. Every page runs the same script — the visitor is told a check has failed, then walked through pasting a command. Windows visitors were sent Stealc or Rhadamanthys; macOS visitors were sent AMOS. Distribution ran through affiliate crews rather than one operator, which is why the naming conventions wander while the page templates do not. We hold this as a single estate because that is how the source groups it; the individual lure themes are tagged separately below.

Sekoia's research team followed a set of look-alike hosts that reproduce the joining screen of Google's video-conference service, down to an invented meeting code in the path. A dialog claims the microphone or headset has failed, and the repair button loads the clipboard. On Windows the pasted line calls mshta against a remote HTML Application; its obfuscated VBScript kills the parent process, pulls two executables over BITS, then reports success or failure together with the machine's public address. What lands is Stealc and Rhadamanthys, each wrapped by the HijackLoader crypter. Visitors identified as macOS receive a disk image instead, recognised as AMOS. Two Russian-speaking traffer crews, Slavic Nation Empire and Scamquerteo, sent victims to the same template, and a Telegram bot fed by the operators' backend counted every visit and download.

OBSCURE#BAT is the name Securonix gave to activity that installs an altered build of r77, an open-source rootkit whose value to an operator is staying hidden and staying put. Microsoft attributes one of the lure pages it pulls apart in this write-up to that same cluster. The page presents itself as a Discord server that wants a visitor identified before letting them join, and borrows the platform's own logo to sell the idea. Its script waits for the verify button and then uses the browser's clipboard interface to load a command, with no hidden frame and no message from another document involved — plainer than the other example Microsoft dissects, where a concealed frame signals the parent page. Recorded alongside it are a landing page, a batch file on a public file host, and two addresses used for control between February and March 2025.