Malware research group MalwareHunterTeam (@malwrhunterteam) posted on X on 11 November 2026 that freemeetly[.]com, a site presenting itself as "FreeMeetly", a browser-based meeting and booking service, serves a packag…
Source: x.com · published
Malware research group MalwareHunterTeam (@malwrhunterteam) posted on X on 11 November 2026 that freemeetly[.]com, a site presenting itself as "FreeMeetly", a browser-based meeting and booking service, serves a package at freemeetly[.]com/download/v1.0.3/mac-x86_64.zip. The researcher said ESET detects the download as "Python/DeceptiveDevelopment.S Trojan" and suggested a possible North Korean link; the VirusTotal screenshot shared in the thread shows the domain was created about 12 days earlier and that the file poses as a Python packaging library while bundling hidden, obfuscated payloads. DeceptiveDevelopment is the name ESET uses for campaigns that send job seekers and freelancers to fake meeting or interview software. Do not install meeting apps from links sent by recruiters or new contacts; use well-known services from their official sites.
Fake meeting or productivity sites often offer a free Mac or Windows download that is in fact malware. According to the research post, the file at freemeetly.com/download/v1.0.3/mac-x86_64.zip was detected by ESET as Python/DeceptiveDevelopment.S, a trojan family sometimes linked in industry reporting to North Korean-aligned operators; that attribution is the researcher's comment, not a finding by scammers.com.
Do not install software from a site you reached through an unexpected invite, advert or search result. If you already opened the archive, disconnect the Mac from the network and have it checked before you enter passwords or wallet keys on it again.
A polished marketing page and a versioned download path are not evidence that the file is safe. Prefer meeting software from a vendor you already use and from a store or site you typed yourself.
Public post on X, 11 November 2026: https://x.com/malwrhunterteam/status/2120478855630918125
The indicators come from this source and have not been independently checked by scammers.com.
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
MalwareTips published an investigation today rating deniudy.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new na…
MalwareTips published an investigation today rating thebakedbox.in a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…
MalwareTips published an investigation today rating grace-bags.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…
MalwareTips published an investigation today into the 'Wexford Advisory' crypto and stock trading site. It reports that Spain's securities regulator, the CNMV, lists the name twice as a clone: an October 19, 2026 entr…
PhishDestroy posted on Mastodon on 12 November 2026 three .shop domains it flagged: yervion[.]shop, xorlena[.]shop and xireka[.]shop. Its records show all three were registered on 1 July 2026 and use the same storefro…