A cybersecurity campaign has targeted security professionals by using a fake cryptocurrency conference as a lure. The attacker, posing as an employee of a leading crypto news site, approached potential victims on the social media platform X. Leveraging Google Docs and Google App Script, the hacker created a seemingly legitimate planning document for a non-existent conference. This document featured a sidebar designed to appear encrypted, aiming to trick targets into entering a fake decryption key.
This initial step was part of a larger scheme to install malware on the victims' computers. Depending on the operating system, the hacker attempted to deploy an infostealer for macOS, a repurposed remote desktop tool for Windows, and a fake installer for the Ledger cryptocurrency wallet. Security firm Huntress published details of the campaign, which included one of its own researchers posing as a victim to gather intelligence.
The hacker's use of legitimate Google features and a plausible scenario, combined with broken English, made the attack more convincing. This incident highlights the ongoing efforts by malicious actors to target cybersecurity experts, even when using sophisticated social engineering tactics.
