Meeten Malware: A Cross-Platform Threat to Crypto Wallets on macOS and Windows

Cado Security Labs (now part of Darktrace) identified a cross‑platform campaign, Meeten, that deploys the Realst information stealer for macOS and Windows and targets Web3 workers. The threat actors create AI‑generated fake Web3 companies and use social media to entice targets to download a meeting application from the Meeten site, with the campaign also cycling through names such as Meetio and Clusee[.]com.

On macOS, the downloader is called CallCSSetup.pkg and the main stealer operates via a Rust‑based binary named fastquery, prompting for passwords and exfiltrating data to a remote server while collecting credentials, browser data, and wallet information. A Windows variant, MeetenApp.exe, is NSIS‑based and appears to be an Electron application, with Bytenode‑compiled JavaScript and a second payload UpdateMC.exe that also exfiltrates data including wallet details to 172.104.133[.]212.

The actors use registry Run keys for persistence and exfiltrate data as ZIP archives, with indicators including domains such as meeten[.]us, meetio[.]one and meetone[.]gg cited in IoCs.