Fake CoinDesk conference lure used Google Docs to target security researchers with malware

A threat actor posing as a CoinDesk executive used X and Google Docs to target cybersecurity professionals around the Black Hat and DEF CON conferences, according to a Huntress investigation published August 20. The operation used a Google document with a custom Google Apps Script sidebar to make malware installation look like document decryption or software updating. [5]

Huntress confirmed that one of its researchers was targeted but did not fall for the lure. The company said the account had contacted a large number of conference attendees using largely boilerplate replies. It did not establish how many people opened the document or installed malware. [6]

On August 9, the X account `@HartmansDoeke` sent messages claiming to represent CoinDesk’s vice president and head of marketing. The account asked researchers their conference plans and a supposed online event. Huntress said the profile appeared to combine one person’s photograph with another person’s name. [7]

The recipient was then sent a Google Doc presented as a conference-planning document. Google’s documentation confirms that Apps Script projects bound to Google Docs can display custom HTML sidebars, prompts and dialogs inside the editor. The attacker used that legitimate interface capability to present a fake decryption workflow. [8]

The sidebar accepted an “access key” supplied in the X conversation, then deliberately showed a failed decryption attempt. It followed with ClickFix-style instructions and a download option disguised as a document update. Huntress said the script collected host and victim information and reported activity through Telegram. [9]

On macOS, the manual-download path led to a GitHub Releases page hosting `GAPIUpdate.dmg`. Huntress’ analysis found an ad-hoc-signed application with characteristics highly consistent with Atomic macOS Stealer, or AMOS. The sample targeted browser passwords and cookies, cryptocurrency wallets, Keychain data and Telegram files. It also requested access to the user’s Notes database and established persistence through `/Library/LaunchDaemons/com.xdivcmp.plist`. [10]

The macOS chain used `apple-googleapi[.]com` for its ClickFix-style command path and sent staged data to `86.54.25[.]213`; a separate backdoor polled `192.253.248[.]181`. Huntress said the backdoor supported actions including arbitrary shell execution and enabling a SOCKS5 proxy. [11]

The Windows branch offered a fake “Google API Connector” update through a ClickOnce manifest named `GapiUpdate.application`, hosted at `gapidriver[.]com`. Huntress found that the installer displayed a counterfeit Google Workspace Marketplace page while downloading additional components. The manual path used an encoded PowerShell loader hosted at `1foqo[.]lat`. [12]

A second document increased the pressure on the target. It imitated a Dropbox DocSend and offered a fake desktop installer. Depending on the browser’s operating system, the infrastructure served AMOS on macOS or a Windows chain that included NetSupport Manager, a Ledger wallet implant and a local TLS-intercepting proxy. [13]

NetSupport Manager is legitimate remote-administration software, but the sample was configured as a covert remote-access tool. Its tray icon, alerts and user-facing controls were disabled, and its command infrastructure used domains named `msedgewebview1[.]pro` and `msedgewebview2[.]pro` to resemble Microsoft Edge WebView traffic. [14]

The proxy component created a self-signed certificate authority presented as `O=Google Trust Services, CN=WR3`, installed it in the Windows root store and redirected ` to `127.0.0.1` through the hosts file. Huntress said the private key remained on disk, allowing the operator to mint certificates for other domains in principle. The certificate authority, hosts-file change and firewall rule could remain after the process that created them was removed. [15]

The Ledger component searched for Ledger Live installations, created a registry persistence entry named `Ledger Wallet Installer` and polled `eu07connect[.]com` for commands. Huntress observed the polling channel but received empty responses during analysis, so it could not confirm whether the implant had been tasked against a live victim. [16]

Huntress published indicators including `GAPIUpdate.dmg`, the SHA-256 hash `15afe14b5db2896d35a0c4f3139db85158da120fa90613c975c88f10bbbcc420`, `/tmp/lksopo`, `com.xdivcmp.plist`, `DocsendInstaller.exe`, `Manager.msi`, `Localcertificate.exe` and `Asusdriverld.exe`. Windows teams should also review traffic to `docsend[.]online`, `docsend[.]web12api[.]com`, `eu03hub[.]com`, `msedgewebview1[.]pro`, `msedgewebview2[.]pro` and `87.120.104[.]88`. [17]

Anyone who ran commands from the document or installed one of the counterfeit applications should isolate the system, preserve relevant evidence and consider reimaging it. Organizations should revoke active sessions, reset passwords, rotate API keys and other secrets, and review cryptocurrency wallets from a clean device. macOS administrators should check LaunchDaemons and staged files; Windows administrators should inspect root certificates, hosts-file changes, firewall rules, ClickOnce activity and unexpected NetSupport installations. [18]

Huntress did not assign the campaign to a named threat actor. Russian-language and Cyrillic strings appeared in parts of the code and network traffic, but those details do not establish nationality or organizational control. The confirmed facts are the impersonation, the Google Docs delivery mechanism, the platform-specific payloads and the still-unknown number of successful compromises. [19]