Attendees of cybersecurity conferences should be on the lookout for malicious outreach following the event, according to a new Huntress blog which details one such interaction.
The post, published on August 19, explained that a researcher for the security vendor was targeted on X following Black Hat / Def Con this summer.
Masquerading as CoinDesk’s VP and head of marketing, the malicious actor first asked for help with a fictitious upcoming conference.
The researcher spotted the scam but expressed interest to better understand the tactics being used.
Read more on phishing: Compromised WordPress Sites Deliver ClickFix Attacks in Global Infostealer Campaign
The actor subsequently sent the researcher a Google Doc disguised as a planning document for the supposed conference.
“The Google Doc was more than your typical phishing lure leading to a malicious web page. If an authenticated Google user opened it, a custom Google Apps Script sidebar was presented alongside the document,” Huntress explained.
“The document asked the user to enter an ‘encryption key’ (supplied by the actor in DMs), which appeared to fail when entered. The sidebar provided two follow-on options: ClickFix-style instructions and a download option, both intended to download and execute malicious code.”
A Persistent Scammer
The researcher didn’t fall for the malicious Google Doc. But that didn’t stop the threat actor, who followed up the next day with another.
This one was apparently disguised as a Dropbox DocSend share and led to a counterfeit DocSend installer.
The installer delivered different payloads depending on the machine the victim was running. For macOS it was an infostealer known as AMOS. For Windows, it was an implant designed to steal cryptocurrency from Ledger wallets, and a traffic-intercepting proxy designed to help the malware evade security software or checks reliant on VirusTotal.
“Taken together, the two lures show how the threat actor used familiar platforms to build credibility and keep the target engaged,” Huntress explained. “By combining social media DMs with trusted document and file-sharing services, the actor created a legitimate-looking workflow designed to trick targets into running the malware.”
When that approach didn’t work, the actor apparently pivoted yet again, by asking the researcher if they knew anyone who wanted funding of up to $1m.
This could have been another pretext to steal credentials or personally identifiable information (PII) from the researcher, they hypothesized.
Advice for Conference-Goers
Huntress advised any recent returnee from a conference to be on the lookout for legitimate-looking messages which lead to a document or installer where the user is asked to take actions that security controls would normally prevent.
“Unexpected requests to run terminal commands, bypass Gatekeeper, install a manual update, or enter a device password are all strong indicators of an attempt to compromise rather than routine troubleshooting in a situation like this,” it concluded.
If any users have interacted with such a message, Huntress advised that they:
- Isolate the system from the network
- Collect relevant forensic evidence and consider reimaging the system
- Assume that credentials have been compromised
- Revoke active sessions, reset passwords, and rotate API keys or any other secrets residing on the system
- Review cryptocurrency wallets if relevant
