Warning: Markopolo's Scam Targeting Crypto Users via Fake Meeting Software

Recorded Future's analysis attributes a cross-platform campaign to an actor dubbed "markopolo" who promotes a fake virtual meeting app (Vortax) across social media and messaging channels to trick crypto users into downloading installers that deploy infostealer malware (including macOS-focused stealers). The campaign uses RoomID-based invites, redirected hosting (Dropbox/external sites), and shared C2 infrastructure to quickly pivot lures; at least one victim reportedly lost $245,000. The report also highlights broader trends of cloud storage abuse by scammers to host phishing landing pages.