In the murky waters of Web3, a new scam has surfaced, bringing the fusion of AI trickery and crypto-stealing malware to the forefront. Dubbed “Realst,” this info-stealer is targeting macOS and Windows users alike, and it’s no run-of-the-mill scam. With AI-generated websites, social media personas, and a revolving door of fake company names (looking at you, Meetio), this campaign is as sophisticated as it is sinister.
Fake Meetings, Real Consequences
The bait is simple yet clever: a business opportunity, usually initiated via Telegram, followed by a request to schedule a video call. Victims are then directed to download a supposed meeting application from a polished, AI-generated website. Spoiler alert: the app, “Meeten,” is not here to facilitate meetings but to pilfer credentials, cookies, and even your hard-earned crypto.
With names like Clusee, Cuesee, Meeten[.]gg, and now Meetio, the fake company reinvents itself regularly. Each iteration is accompanied by slick websites, social media activity, and enough AI-crafted content to make a tech-savvy user pause—just long enough to become the next victim.
The Technical Dirt: What Realst Stealer Does
macOS: The Sneaky Setup
Once the victim downloads the macOS variant, it’s game over. Here’s what happens:
· The malware masquerades as a meeting app but is a Rust-written binary aptly named “fast query.”
· Upon installation, it throws up error messages to distract users while quietly harvesting sensitive data, from Telegram credentials to crypto wallet keys.
· This treasure trove of information is zipped and sent off to a command-and-control (C2) server.
Windows: Same Scam, Different Package
The Windows variant doesn’t pull any punches:
· Disguised as “MeetenApp.exe,” it’s an Electron-based app signed with a stolen legitimate certificate. Sneaky, right?
· The malware gathers system info and digs through browser credentials, wallets, and other data-rich targets.
· To keep itself alive, it plants a registry key ensuring it runs at every startup.
The AI Edge: Faking It ‘Til They Take It
What sets this scam apart isn’t just the malware but the polished facade. The threat actors have gone full AI, leveraging generative tools to create:
· Websites: Complete with blogs, product descriptions, and FAQs that could fool even Sherlock Holmes.
· Social Media Personas: Twitter and Medium accounts that lend credibility to their scheme.
· Business Presentations: Some victims reported receiving authentic-looking investment decks, upping the ante on the social engineering front.
Lessons for Web3 Warriors
1. Trust, But Verify: A known contact on Telegram? Double-check before diving in. Call them on a verified number.
2. Scan, Then Plan: Before downloading any application, run a thorough malware scan and verify its source.
3. AI is a Double-Edged Sword: While AI powers innovation, it also fuels deception. Be cautious of overly polished content.
4. Guard Your Crypto: Use hardware wallets and avoid storing private keys in your browser.
.png)
.png)