{"id":"CMP-202611-73mmws","kind":"campaign","aliases":[],"related":[],"title":"Fake 'Freemeetly' meeting app site (freemeetly[.]com) serves a Python trojan for Mac, detected by ESET as DeceptiveDevelopment (possibly North Korean)","description":null,"summary":"MalwareHunterTeam (2026-11-11) found freemeetly[.]com, a site posing as a meeting/video-call app, serving a download at freemeetly[.]com/download/v1.0.3/mac-x86_64.zip. ESET detects it as 'Python/DeceptiveDevelopment.S Trojan'; DeceptiveDevelopment is the name ESET uses for a North Korea-linked cluster, but the researcher only suggests that link ('so North Korean?'), it is not confirmed. The archive was uploaded to MalwareBazaar by @smica83. How victims are sent to the site (fake job interview, chat invite or other) is unknown; only the macOS x86_64 build is confirmed, other platform builds are unknown. Active since: unknown (seen live 2026-11-11).","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-11T12:00:21+00:00","products":[{"name":"macOS","fixed":[],"vendor":"Apple","affected":""}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look in proxy/DNS logs, browser history and downloads for the domain freemeetly[.]com and the URL path /download/v1.0.3/mac-x86_64.zip, and for a file named mac-x86_64.zip in Downloads. Check endpoint AV/EDR for the detection 'Python/DeceptiveDevelopment.S' (ESET). Treat any message asking you to install 'Freemeetly' to join a call or interview as malicious. File hashes: see the MalwareBazaar entry for mac-x86_64.zip (not quoted in the posts).","fix":"Block freemeetly[.]com. Do not install meeting software from a link someone sends; join calls with the tools your organization already uses. If mac-x86_64.zip was downloaded and opened, isolate the Mac, and from a clean device rotate passwords, browser-saved logins, SSH/cloud keys and crypto wallet keys used on it.","status":"open","published_at":null,"first_seen_at":"2026-11-11T12:00:21+00:00","triaged_at":"2026-11-11T12:00:21+00:00","updated_at":"2026-11-11T12:01:29+00:00","category":"other","confidence":null,"triage":{"cause":{"at":"2026-11-11T12:01:48Z","path":"tampered-install","entry":"unknown","reason":"The record describes a fake 'Freemeetly' site serving a trojanized mac-x86_64.zip download to people who install it, but it never says how an attacker got into any breached organisation, and how victims were lured is stated as unknown.","confidence":0.8}},"analyst_status":"done","analyst_note":null,"search":"'-11':33B,34B,127B,128B '-202611':23A '-73':24A '2026':32B,126B '64':112B 'activ':121B 'app':4A,44B 'archiv':85B 'build':113B,118B 'campaign':27B 'chat':102B 'cluster':69B 'cmp':22A 'com':7A,37B 'com/download/v1.0.3/mac-x86_64.zip':50B 'confirm':83B,115B 'deceptivedevelop':18A,57B 'detect':14A,52B 'download':47B 'earli':29B 'early-warn':28B 'eset':16A,51B,61B 'fake':1A,99B 'found':35B 'freemeet':2A,6A,36B,49B 'interview':101B 'invit':103B 'job':100B 'korea':67B 'korea-link':66B 'korean':21A,79B 'link':68B,76B 'live':125B 'mac':13A 'maco':110B 'macos':26A 'malwarebazaar':89B 'malwarehunterteam':31B 'meet':3A 'meeting/video-call':43B 'mmws':25A 'name':60B 'north':20A,65B,78B 'platform':117B 'pose':40B 'possibl':19A 'python':10A 'python/deceptivedevelopment.s':55B 'research':72B 'seen':124B 'sent':95B 'serv':8A,45B 'sinc':122B 'site':5A,39B,98B 'smica83':91B 'suggest':74B 'trojan':11A,56B 'unknown':107B,120B,123B 'upload':87B 'use':62B 'victim':93B 'warn':30B 'x86':111B","nicknames":["Freemeetly"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["freemeetly","macos"],"ptokens":["macos"],"labels":["campaign","earlywarning","high","other"],"campaign_type":"malware","search_a":"'-202611':23A '-73':24A 'app':4A 'cmp':22A 'com':7A 'deceptivedevelop':18A 'detect':14A 'eset':16A 'fake':1A 'freemeet':2A,6A 'korean':21A 'mac':13A 'macos':26A 'meet':3A 'mmws':25A 'north':20A 'possibl':19A 'python':10A 'serv':8A 'site':5A 'trojan':11A","search_b":"'-11':33B,34B,127B,128B '2026':32B,126B '64':112B 'activ':121B 'app':44B 'archiv':85B 'build':113B,118B 'campaign':27B 'chat':102B 'cluster':69B 'com':37B 'com/download/v1.0.3/mac-x86_64.zip':50B 'confirm':83B,115B 'deceptivedevelop':57B 'detect':52B 'download':47B 'earli':29B 'early-warn':28B 'eset':51B,61B 'fake':99B 'found':35B 'freemeet':36B,49B 'interview':101B 'invit':103B 'job':100B 'korea':67B 'korea-link':66B 'korean':79B 'link':68B,76B 'live':125B 'maco':110B 'malwarebazaar':89B 'malwarehunterteam':31B 'meeting/video-call':43B 'name':60B 'north':65B,78B 'platform':117B 'pose':40B 'python/deceptivedevelopment.s':55B 'research':72B 'seen':124B 'sent':95B 'serv':45B 'sinc':122B 'site':39B,98B 'smica83':91B 'suggest':74B 'trojan':56B 'unknown':107B,120B,123B 'upload':87B 'use':62B 'victim':93B 'warn':30B 'x86':111B","search_c":"","cause_entry":"unknown","cause_path":"tampered-install","disclosures_checked_at":null,"first_public_at":"2026-11-11T11:21:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-73mmws","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-11T12:00:21+00:00","fetched_at":"2026-11-11T12:00:21+00:00","note":null}],"documents":[{"id":125082,"url":"https://x.com/malwrhunterteam/status/2120478855630918125","title":"@malwrhunterteam: Some totally legit looking package comes from here: https://freemeetly[.]com/dow","kind":"post","source":"x","publisher":null,"text":"Some totally legit looking package comes from here: https://freemeetly[.]com/download/v1.0.3/mac-x86_64.zip\n😂\nESET detected as \"Python/DeceptiveDevelopment.S Trojan\", so North Korean?\n🤔\n🤷‍♂️ https://t.co/uFNl8fGFJQ\n\nlikes 2 reposts 0","published_at":"2026-11-11T11:28:50+00:00","relation":"describes","confidence":null,"note":null},{"id":124921,"url":"https://x.com/malwrhunterteam/status/2120476917514338335","title":"@malwrhunterteam: https://freemeetly[.]com/\n🤔\n🤷‍♂️ https://t.co/OhXIdFvUqq","kind":"post","source":"x","publisher":null,"text":"https://freemeetly[.]com/\n🤔\n🤷‍♂️ https://t.co/OhXIdFvUqq\n\nlikes 0 reposts 1","published_at":"2026-11-11T11:21:08+00:00","relation":"describes","confidence":null,"note":null},{"id":125099,"url":"https://x.com/malwrhunterteam/status/2120482024377004480","title":"@malwrhunterteam: And @smica83 uploaded that \"mac-x86_64.zip\" archive to Bazaar: https://t.co/ynh8","kind":"post","source":"x","publisher":null,"text":"And @smica83 uploaded that \"mac-x86_64.zip\" archive to Bazaar: https://t.co/ynh8kudJ6h\n\nlikes 0 reposts 0","published_at":"2026-11-11T11:41:25+00:00","relation":"describes","confidence":null,"note":null},{"id":124920,"url":"https://x.com/malwrhunterteam/status/2120477183189917701","title":"@malwrhunterteam: 🤷‍♂️ https://t.co/QvW427htup","kind":"post","source":"x","publisher":null,"text":"🤷‍♂️ https://t.co/QvW427htup\n\nlikes 0 reposts 0","published_at":"2026-11-11T11:22:11+00:00","relation":"discussion","confidence":0.6,"note":"MalwareHunterTeam post in the same thread, image only"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}