---
id: "CMP-202611-73mmws"
page: "https://infrastack.ai/live/CMP-202611-73mmws"
kind: "campaign"
aliases: []
title: "Fake 'Freemeetly' meeting app site (freemeetly[.]com) serves a Python trojan for Mac, detected by ESET as DeceptiveDevelopment (possibly North Korean)"
severity: "high"
cvss: null
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "macOS", "fixed": [], "vendor": "Apple", "affected": ""}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-11T12:00:21+00:00"
updated_at: "2026-11-11T12:01:29+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-11T12:00:21+00:00"}]
exploit_sources: []
---

# Fake 'Freemeetly' meeting app site (freemeetly[.]com) serves a Python trojan for Mac, detected by ESET as DeceptiveDevelopment (possibly North Korean)

Link for people: https://infrastack.ai/live/CMP-202611-73mmws (this .md is for agents)

MalwareHunterTeam (2026-11-11) found freemeetly[.]com, a site posing as a meeting/video-call app, serving a download at freemeetly[.]com/download/v1.0.3/mac-x86_64.zip. ESET detects it as 'Python/DeceptiveDevelopment.S Trojan'; DeceptiveDevelopment is the name ESET uses for a North Korea-linked cluster, but the researcher only suggests that link ('so North Korean?'), it is not confirmed. The archive was uploaded to MalwareBazaar by @smica83. How victims are sent to the site (fake job interview, chat invite or other) is unknown; only the macOS x86_64 build is confirmed, other platform builds are unknown. Active since: unknown (seen live 2026-11-11).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :macOS affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record describes a fake 'Freemeetly' site serving a trojanized mac-x86_64.zip download to people who install it, but it never says how an attacker got into any breached organisation, and how victims were lured is stated as unknown.

How it reached others: their users installed or auto-updated it (tampered-install).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#tampered-install

## How to check

Look in proxy/DNS logs, browser history and downloads for the domain freemeetly[.]com and the URL path /download/v1.0.3/mac-x86_64.zip, and for a file named mac-x86_64.zip in Downloads. Check endpoint AV/EDR for the detection 'Python/DeceptiveDevelopment.S' (ESET). Treat any message asking you to install 'Freemeetly' to join a call or interview as malicious. File hashes: see the MalwareBazaar entry for mac-x86_64.zip (not quoted in the posts).

## Fix

Block freemeetly[.]com. Do not install meeting software from a link someone sends; join calls with the tools your organization already uses. If mac-x86_64.zip was downloaded and opened, isolate the Mac, and from a clean device rotate passwords, browser-saved logins, SSH/cloud keys and crypto wallet keys used on it.

## Timeline

- 2026-11-11T12:00:21+00:00 analyst

## Documents

- [describes] @malwrhunterteam: Some totally legit looking package comes from here: https://freemeetly[.]com/dow https://x.com/malwrhunterteam/status/2120478855630918125
- [describes] @malwrhunterteam: https://freemeetly[.]com/
🤔
🤷‍♂️ https://t.co/OhXIdFvUqq https://x.com/malwrhunterteam/status/2120476917514338335
- [describes] @malwrhunterteam: And @smica83 uploaded that "mac-x86_64.zip" archive to Bazaar: https://t.co/ynh8 https://x.com/malwrhunterteam/status/2120482024377004480
- [discussion] @malwrhunterteam: 🤷‍♂️ https://t.co/QvW427htup https://x.com/malwrhunterteam/status/2120477183189917701

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_