Loading story…
A threat actor targeted security researchers after Black Hat and DEF CON by impersonating a senior CoinDesk-linked cryptocurrency media executive on X and sending conference-planning lures through trusted services including Google Docs, GitHub Releases, and Dropbox DocSend. Huntress reported that the first lure used a booby-trapped Google Doc with a malicious Google Apps Script sidebar that asked victims for an "encryption key," profiled the host, and then steered users into staged malware delivery paths tailored to macOS and Windows systems.
On macOS, victims were served a disk image resembling Atomic macOS Stealer (AMOS), while Windows targets received a fake Google API Connector update that led to a ClickOnce application, PowerShell-based loaders, and additional payloads. Huntress said the Windows chain ultimately deployed NetSupport RAT, a fake Ledger wallet application, and a local TLS-intercepting proxy built around a rogue certificate authority, indicating goals that included credential theft, cryptocurrency wallet compromise, and persistent remote access; when the first attempt failed, the actor followed up with a second malicious document disguised as a DocSend share to continue the intrusion attempt.
Get the infrastructure and lures behind it.
15 events from the most recent confirmed update back to the earliest known activity.
On August 9, a threat actor using the X account @HartmansDoeke impersonated CoinDesk's VP and Head of Marketing and sent a direct message to a researcher about helping with an upcoming conference. Huntress said similar outreach was sent to multiple Black Hat and DEF CON attendees.
Using a honeypot account during the November 2025 campaign, Volexity observed subsequent attacker activity from a residential Comcast IP address in the United States that Spur associated with a proxy network.
In November 2025, Volexity observed broader spear-phishing from an attacker-created Gmail account targeting multiple customers. The emails linked to bsc2025[.]org, a fake Belgrade Security Conference site that selectively redirected targets into a Microsoft 365 phishing workflow.
During the October 2025 compromise, the attacker created a new device in Microsoft Entra ID named to match an existing victim device, apparently to maintain access after the phishing succeeded.
In October 2025, Volexity investigated a compromised Microsoft 365 account after anomalous login activity. The intrusion began with a spear-phishing email continuing a legitimate Belgrade Security Conference thread and led to attacker access to Microsoft 365 files.
Volexity had previously reported on the Russian threat actor UTA0355 in April 2025 before linking it to later phishing campaigns spoofing European security events.
In early 2025, Volexity published two blog posts about Russian threat actors abusing Microsoft 365 OAuth and Device Code authentication workflows, establishing the backdrop for later related campaigns.
After earlier malware-delivery attempts failed, the threat actor shifted tactics and offered funding of up to $1 million to keep the target engaged. Huntress assessed this may have been another pretext to steal credentials or personally identifiable information.
Huntress found the counterfeit DocSend installer for Windows fingerprinted the host, executed staged JavaScript in memory, and ultimately deployed NetSupport Manager RAT, a rogue certificate authority with local HTTPS interception capability, and a Ledger wallet implant.
The day after the initial failed attempt, the attacker sent a second malicious document masquerading as a Dropbox DocSend file share. This follow-on lure again delivered AMOS to macOS users and a Windows malware bundle to Windows users.
In the same campaign, the Windows path presented a fake Google API Connector update that led to a ClickOnce application signed with a likely stolen or fraudulently obtained certificate. The chain downloaded additional payloads including NetSupport RAT and other malware components.
In the first post-DEF CON lure, the macOS path either instructed users to run a terminal command or directed them to a GitHub Releases-hosted disk image, GAPIUpdate.dmg. Huntress found the payload closely matched Atomic macOS Stealer and included persistence and data theft capabilities.
After the X conversation began, the actor sent a Google Docs file that loaded a custom Google Apps Script sidebar and prompted the target for an attacker-supplied encryption key. The script collected victim information, sent updates through Telegram, and branched into separate macOS and Windows infection paths.
Talos observed a spike in activity for the Cyber Conflict-themed Seduploader campaign on October 7, 2023, indicating increased use of the malicious decoy document and malware delivery chain.
Cisco Talos reported that a new Group 74/APT28 campaign targeting people interested in cybersecurity likely started on October 4, 2023, using a Word decoy document themed around the Cyber Conflict U.S. conference.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
10 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourceitpro.com
Open sourcetechcrunch.com
Open sourcescworld.com
Open sourceitsecurityguru.org
Open sourcehuntress.com
Open sourcevolexity.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor impersonated a CoinDesk marketing executive in X direct messages, using post-Black Hat and DEFCON cryptocurrency-conference lures to target security researchers. The messages linked to legitimate Google Docs containing container-bound Google Apps Script that profiled visitors and sent their IP address, geolocation, browser details, and cryptocurrency-wallet-extension data to the operator through Telegram. The campaign routed victims to operating-system-specific malware: macOS users received a variant of the AMOS infostealer, while Windows users were served an encoded PowerShell loader chain and installers signed with three stolen or fraudulently issued certificates. Recovered Windows components included a malicious NetSupport Manager deployment, a persistent rogue local certificate authority capable of TLS interception, and a Ledger-wallet-focused implant. Russian-language comments and C2 artifacts indicate the operator may be Russian-speaking, but no threat group has been attributed.
Sep 14, 2026
An exposed staging environment uncovered by CloudSEK revealed a financially motivated, Chinese-speaking threat operator using multiple AI coding agents as an autonomous offensive platform to support cryptocurrency theft and mass compromise operations. Files in the open directory documented two campaigns running from 10 July to 28 July 2026: opportunistic WordPress exploitation for cryptojacking and targeted intrusions against cryptocurrency and DeFi organizations. The leaked workspace contained more than **12,000** WordPress backdoor records, **66** harvested administrator credential sets, a reconnaissance corpus covering **3.4 million** hosts, live API keys and admin tokens, and stolen cryptocurrency wallet private keys and seed phrases. CloudSEK said the operator managed agents through Telegram, disabled approval safeguards, and reused a fake Chinese-language "authorized pentest" jailbreak prompt to drive offensive actions, while also developing a blockchain-based `DeadDropC2` framework that appeared to remain in local testing. A separate exposed repository on `45.61.136.49` showed the same broader pattern of openly accessible attacker infrastructure, this time serving macOS malware through downloader scripts named **Chrome**, **claude**, and **codex**. Those scripts retrieved a Mach-O universal binary called `codexclod`, cleared macOS quarantine attributes, made the file executable, and launched it, suggesting a delivery chain designed to lure Apple users with trusted software and AI-brand filenames. Investigators found no victim databases or proprietary documents in that repository, but the staging setup reinforced how misconfigured attacker infrastructure can expose active payload delivery, tooling, and operational tradecraft tied to credential compromise and crypto-focused theft.
Aug 20, 2026
Researchers and incident responders documented a targeted intrusion campaign by **CryptoMimic**—also tracked as **Dangerous Password**, **CageyChameleon**, and **Leery Turtle**—that focused on banks, financial organizations, and especially cryptocurrency businesses. The attacks used spear-phishing lures that delivered ZIP or RAR archives containing malicious `.lnk` shortcut files and decoy documents; when opened, the shortcuts launched `mshta.exe` to fetch remote HTML or VBScript payloads. JPCERT/CC said the activity hit Japanese organizations tied to cryptocurrency operations, while later analysis captured a full intrusion chain in which the initial script deployed staged implants including **Cabbage RAT** variants, a browser information stealer, **msoRAT**, and a credential theft component that abused Windows Security Packages. Across the reports, the malware showed consistent tradecraft: persistence through Startup-folder shortcuts and registry changes, victim filtering and antivirus checks, host reconnaissance via WMI, and command-and-control through **Bitly** links and spoofed cloud-themed domains such as **cloudfiles.club** and **msupdatepms.xyz**. The operators collected browser cookies, saved passwords, OS and hardware details, process lists, and likely system credentials, then used interactive follow-on access, including legitimate **VNC** tools, for manual post-compromise activity and possible cryptocurrency theft. Investigators also observed cleanup actions such as event log deletion and destructive behavior, and noted that the tooling and operational patterns shared multiple similarities with activity previously linked to **Lazarus**, though attribution remained unconfirmed.
Aug 15, 2026