The Travels of “markopolo”: Self-Proclaimed Meeting Software Vortax Spreads Infostealers, Unveils Expansive Network of Malicious macOS Applications
ID: a91b15ab-0136-5361-9811-f62babeae4ed
STIX ID: report--a91b15ab-0136-5361-9811-f62babeae4ed
Feed Name: Recorded Future Blog
Threat Score
Recorded Future’s Insikt Group uncovered a campaign where a fraudulent macOS meeting app, Vortax, installs three infostealers (Rhadamanthys, Stealc, and AMOS) to harvest credentials and cryptocurrency-related data. The operation, attributed to the actor "markopolo," leverages shared hosting and resilient C2 infrastructure, suggesting a scalable credential-harvesting and possible "log vendor" resale model; defenders are urged to update detections, restrict unapproved downloads, and monitor AMOS-related infrastructure.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.