A threat actor impersonating a senior executive at a well-known cryptocurrency media outlet attempted to infect a Huntress researcher with malware in the days following this year’s Black Hat and DEF CON conferences, according to new research from the security vendor.
The campaign began on X (formerly Twitter), where an account impersonating the executive sent a direct message to the researcher on 9 August, using a fabricated story about planning an upcoming online conference to strike up a conversation. The account reportedly combined one person’s photo with another person’s name and sent similar boilerplate outreach to a large number of other conference attendees in the days after the events.
Rather than disengaging once the approach was identified as fraudulent, the researcher continued the conversation to observe how the attack would unfold, allowing Huntress to document the entire attack chain from first contact through payload delivery.
A Google Doc with a hidden trick
The lure itself went beyond a typical phishing link. The actor shared what appeared to be a planning document for the fictional conference, hosted on Google Docs. Once opened by an authenticated Google account, the document loaded a custom sidebar built with Google Apps Script (the file was named DecryptPanel.html), which prompted the recipient to enter an “encryption key” supplied earlier in the conversation.
Entering the key produced a deliberate “failure” message, according to Huntress, which then prompted the target to work through the sidebar’s “Document Decryption” options: a ClickFix-style command to run manually, or a “Manual Update” download. Researchers noted the underlying script validated a limited set of hard-coded keys, gathered information about the victim and their device, sent activity updates via Telegram, and branched into separate infection paths depending on whether the target was using macOS or Windows. The code reportedly contained comments written in Russian.
Two operating systems, two malware paths
On macOS, targets were directed to run a terminal command that Huntress says pointed to infrastructure caught in a redirect loop at the time of testing, suggesting the payload may not have been fully live. An alternative “Manual Update” path led instead to a GitHub Releases page hosting a disk image, which asked the user to bypass Apple’s Gatekeeper protections to install it. Analysis of the disk image found strong similarities to Atomic macOS Stealer (AMOS), malware built to harvest browser credentials, cryptocurrency wallet data, keychain contents, and Telegram files, before establishing persistence via a scheduled background process.
Windows users following the same decryption flow were instead prompted to install a fake “Google API Connector” update. Huntress found this led to a ClickOnce application signed with a certificate seemingly belonging to a Norwegian company, which the researchers believe was stolen or fraudulently obtained. Once installed, the application displayed a spoofed Google Workspace Marketplace interface while quietly downloading further payloads, including NetSupport RAT, a fake Ledger cryptocurrency wallet application, and a tool capable of intercepting network traffic.
A persistent actor
Huntress said the same threat actor did not give up after the initial attempt failed. The following day, the researcher was sent a second malicious document, this time disguised as a Dropbox DocSend file share. That document led to a fake DocSend installer configured to deliver the AMOS stealer to macOS users, or the same bundle of Windows malware described above.
According to Huntress, the campaign illustrates how attackers are increasingly chaining together trusted, everyday platforms such as social media, cloud document tools and code-hosting sites to build a convincing, multi-step workflow rather than relying on a single suspicious link.
The findings come amid wider warnings about phishing activity targeting attendees of major security conferences, with researchers elsewhere on social media flagging similar campaigns in the weeks following this year’s Black Hat and DEF CON in Las Vegas.
Huntress has published the full technical breakdown of the campaign, including indicators of compromise, on its blog.
