A hacker reportedly targeted several cybersecurity professionals around the time of the Black Hat and Def Con conferences earlier this month. The attacker, who pretended to work for a leading cryptocurrency news website, used social media site X to engage with attendees.
According to security firm Huntress, the hacker leveraged Google Docs in an attempt to trick targets into installing malware. The campaign involved sharing a legitimate Google Doc designed to appear as a planning document for a fake conference. This document featured a sidebar intended to look encrypted, prompting targets to enter a fake decryption key as a first step towards malware installation.
The hacker utilised Google App Script to create the realistic-looking sidebar within the Google Doc. The malware delivered was specific to the target's operating system, including an infostealer for Apple computers, a remote desktop viewing tool repurposed as malware for Windows, and a fake installer for the cryptocurrency wallet Ledger.