Post-DEF CON Phishing Campaign Targets Attendees with Google Docs

Following the DEF CON and Black Hat conferences, a phishing campaign has emerged targeting attendees. A researcher from Huntress was approached via X by an account impersonating CoinDesk's VP, soliciting help for a fictitious conference. The attacker sent a Google Doc that contained a custom sidebar asking for an 'encryption key' to execute malware. When the researcher did not engage, the attacker followed up with another malicious document disguised as a Dropbox DocSend installer. This second document delivered AMOS stealer to macOS and various malware to Windows users. The campaign highlights the use of familiar platforms to build credibility and trick targets into executing malware. Huntress has advised attendees to be vigilant against such phishing attempts.

Key Points: • Phishing campaign targets cybersecurity conference attendees post-event. • Malicious Google Docs used to deliver malware via custom sidebar. • Attendees advised to be cautious of unexpected requests for sensitive actions.