A hacker posing as an employee of a prominent cryptocurrency news website targeted multiple cybersecurity professionals in August 2026, using a fake conference invitation and a manipulated Google Doc to attempt malware installation.
The campaign unfolded around the time of the Black Hat and Def Con hacking conferences. The attacker reached out to security researchers on X — through both public replies and direct messages — impersonating a representative of a leading crypto news outlet. Using broken English, the hacker asked targets whether they planned to attend a follow-up conference, which the attacker claimed was being organized by the same publication.
Security firm Huntress detailed the campaign in a blog post published Wednesday after one of its own researchers was targeted. That researcher chose to engage with the hacker to observe the attack unfold. The hacker shared what appeared to be a legitimate Google Doc — formatted as a conference planning document — that featured a sidebar designed to look like an encryption interface. Targets were prompted to enter a fake “decryption key” supplied by the attacker, which served as the first step toward malware installation. The hacker used Google App Script, a legitimate developer tool for customizing Google Docs interfaces, to make the sidebar appear authentic.
Depending on the target’s operating system, the hacker attempted to install an infostealer for macOS, a remote desktop tool repurposed as malware for Windows, and a fake installer for the Ledger cryptocurrency wallet.
Hackers have previously targeted cybersecurity professionals using a range of methods, including fake social media profiles. What distinguished this campaign, according to Huntress, was the use of a legitimate Google service to add credibility. Google did not respond to a request for comment on whether it had identified this or similar campaigns.
The account identified by Huntress as belonging to the hacker did not respond to a message sent by TechCrunch on X.
Source: TechCrunch