Hackers Pose as Crypto News Site to Bait Security Researchers with Fake Conference Docs
A malicious actor impersonated a crypto news outlet and used a counterfeit conference Google Doc to lure cybersecurity professionals into installing malware.
Around the time of the Black Hat and Def Con events, a threat actor pretended to represent a leading crypto news platform and reached out to security professionals via public replies and direct messages on X. The hacker offered details about a supposed crypto conference and sent a genuine-looking Google Doc, enhanced with Google Apps Script to display an encrypted-style sidebar. Recipients were asked to input a fabricated decryption key, which would trigger the download of macOS infostealer software, a Windows remote-desktop utility repurposed as malware, and a counterfeit Ledger wallet installer.
Huntress disclosed the campaign in a blog post after one of its researchers engaged with the attacker to gather intelligence. The hacker did not respond to a private inquiry from one outlet, and Google has not commented on the incident.
Why it matters
It shows how attackers exploit trusted platforms and event hype to compromise security experts, raising risks for broader cyber defenses.
In this story
