'Vortax' Meeting Software Builds Elaborate Branding, Spreads Infostealers

Recorded Future's Insikt Group attributes a widespread credential-harvesting campaign to a threat actor dubbed "Markopolo," which uses a fake cross-platform virtual meeting app called Vortax to distribute infostealers (Rhadamanthys and Stealc on Windows, Atomic on macOS). The campaign leverages a convincing brand, social media, Telegram/Discord channels and reusable "Room ID" installers to target cryptocurrency users; researchers observed active distribution and recommend updating detection for Atomic, user education, stricter software controls, and monitoring for malicious domains/IPs.