phishing-campaign-intelligencecredential-stealer-activityremote-access-implantidentity-impersonation-fraud

Fake CoinDesk Executive Used Google Docs and DocSend to Deliver AMOS and NetSupport RAT

Social Engineering & Fraud · 10 sources · Updated 3mo ago · First seen Aug 19, 2026

A threat actor targeted security researchers after Black Hat and DEF CON by impersonating a senior CoinDesk-linked cryptocurrency media executive on X and sending conference-planning lures through trusted services including Google Docs, GitHub Releases, and Dropbox DocSend. Huntress reported that the first lure used a booby-trapped Google Doc with a malicious Google Apps Script sidebar that asked victims for an "encryption key," profiled the host, and then steered users into staged malware delivery paths tailored to macOS and Windows systems.

On macOS, victims were served a disk image resembling Atomic macOS Stealer (AMOS), while Windows targets received a fake Google API Connector update that led to a ClickOnce application, PowerShell-based loaders, and additional payloads. Huntress said the Windows chain ultimately deployed NetSupport RAT, a fake Ledger wallet application, and a local TLS-intercepting proxy built around a rogue certificate authority, indicating goals that included credential theft, cryptocurrency wallet compromise, and persistent remote access; when the first attempt failed, the actor followed up with a second malicious document disguised as a DocSend share to continue the intrusion attempt.

Is your org in this campaign?Get the infrastructure and lures behind it.

Hunt this campaign

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

15 events · 2025 – Aug 9, 2026

Reported Aug 20, 20263mo ago
Actor pivoted to $1 million funding pretext after lure failures
After earlier malware-delivery attempts failed, the threat actor shifted tactics and offered funding of up to $1 million to keep the target engaged. Huntress assessed this may have been another pretext to steal credentials or personally identifiable information.
Def Con Attendees Targeted by Persistent Phishing Campaign - Infosecurity Magazine
Reported Aug 19, 20263mo ago
Actor sent second lure disguised as Dropbox DocSend share
The day after the initial failed attempt, the attacker sent a second malicious document masquerading as a Dropbox DocSend file share. This follow-on lure again delivered AMOS to macOS users and a Windows malware bundle to Windows users.
Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON - IT Security Guru
Reported Aug 19, 20263mo ago
Google Doc lure delivered Windows ClickOnce malware chain
In the same campaign, the Windows path presented a fake Google API Connector update that led to a ClickOnce application signed with a likely stolen or fraudulently obtained certificate. The chain downloaded additional payloads including NetSupport RAT and other malware components.
Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON - IT Security Guru
Reported Aug 19, 20263mo ago
Google Doc lure pushed macOS users toward AMOS-like malware
In the first post-DEF CON lure, the macOS path either instructed users to run a terminal command or directed them to a GitHub Releases-hosted disk image, GAPIUpdate.dmg. Huntress found the payload closely matched Atomic macOS Stealer and included persistence and data theft capabilities.
Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON - IT Security Guru
Reported Aug 19, 20263mo ago
Malicious Google Doc delivered conference-planning lure
After the X conversation began, the actor sent a Google Docs file that loaded a custom Google Apps Script sidebar and prompted the target for an attacker-supplied encryption key. The script collected victim information, sent updates through Telegram, and branched into separate macOS and Windows infection paths.
Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON - IT Security Guru
Reported Aug 19, 20263mo ago
Fake DocSend Windows chain deployed NetSupport and interception tools
Huntress found the counterfeit DocSend installer for Windows fingerprinted the host, executed staged JavaScript in memory, and ultimately deployed NetSupport Manager RAT, a rogue certificate authority with local HTTPS interception capability, and a Ledger wallet implant.
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware | Huntress
Aug 9, 20263mo ago
Threat actor initiated post-DEF CON phishing on X
On August 9, a threat actor using the X account @HartmansDoeke impersonated CoinDesk's VP and Head of Marketing and sent a direct message to a researcher about helping with an upcoming conference. Huntress said similar outreach was sent to multiple Black Hat and DEF CON attendees.
Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON - IT Security Guru
Nov 2025
Volexity observed proxy-backed follow-on attacker activity
Using a honeypot account during the November 2025 campaign, Volexity observed subsequent attacker activity from a residential Comcast IP address in the United States that Spur associated with a proxy network.
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
Nov 2025
Broader Belgrade-themed phishing targeted multiple customers
In November 2025, Volexity observed broader spear-phishing from an attacker-created Gmail account targeting multiple customers. The emails linked to bsc2025[.]org, a fake Belgrade Security Conference site that selectively redirected targets into a Microsoft 365 phishing workflow.
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
Oct 2025
Attacker registered lookalike Entra ID device for persistence
During the October 2025 compromise, the attacker created a new device in Microsoft Entra ID named to match an existing victim device, apparently to maintain access after the phishing succeeded.
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
Oct 2025
Belgrade-themed Microsoft 365 compromise investigated
In October 2025, Volexity investigated a compromised Microsoft 365 account after anomalous login activity. The intrusion began with a spear-phishing email continuing a legitimate Belgrade Security Conference thread and led to attacker access to Microsoft 365 files.
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
Apr 2025
Volexity previously reported on UTA0355
Volexity had previously reported on the Russian threat actor UTA0355 in April 2025 before linking it to later phishing campaigns spoofing European security events.
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
2025
Volexity published earlier OAuth/device-code abuse research
In early 2025, Volexity published two blog posts about Russian threat actors abusing Microsoft 365 OAuth and Device Code authentication workflows, establishing the backdrop for later related campaigns.
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks
Reported Oct 22, 20179y ago
APT28 Cyber Conflict lure activity spiked
Talos observed a spike in activity for the Cyber Conflict-themed Seduploader campaign on October 7, 2023, indicating increased use of the malicious decoy document and malware delivery chain.
“Cyber Conflict” Decoy Document Used In Real Cyber Conflict
Reported Oct 22, 20179y ago
APT28 campaign using Cyber Conflict decoy likely began
Cisco Talos reported that a new Group 74/APT28 campaign targeting people interested in cybersecurity likely started on October 4, 2023, using a Word decoy document themed around the Cyber Conflict U.S. conference.
“Cyber Conflict” Decoy Document Used In Real Cyber Conflict

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.

Open in app →

Malware

3 linked

NetSupport RAT AMOS NetSupport Manager RAT

Affected products

4 linked

WindowsMacosLedger LiveGoogle Docs

Organizations

2 linked

HuntressCoinDesk

Observables

57 linked

Domain••••••.comURLhttps://••••••.•••/•••••MD5 hash••••••••••••••••••••••••••••••••IPv4 address•••.•••.••.•••SHA-256 hash

••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

Email address••••@••••••.•••SHA-1 hash••••••••••••••••••••••••••••••••••••••••Domain••••••.ru+49

Indicator values are masked on this page. View all 57 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.

Do you run this?Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.

Hunt This Campaign

Source coverage

Sources

10 references tracked. Mallory keeps watching after this page renders.

Gurucul Threat ResearchNews · Aug 24, 2026

Post-DEF CON Phishing Uses Google Doc Apps Script to Deliver Malware | Community Portal | GuruculOpen source ↗

ItproNews · Aug 21, 2026

Be careful who you talk to at conferences: Security researchers claim they were targeted by cyber criminals after DEF CON event | IT ProOpen source ↗

Techcrunch Com SecurityNews · Aug 20, 2026

Someone targeted security researchers using a fake crypto conference as a lure | TechCrunchOpen source ↗

ScworldNews · Aug 20, 2026

Black Hat/DEF CON attendees targeted in malware scheme with Google Doc lure | news | SC MediaOpen source ↗

2 additional sources from 19-08-2026 to 20-08-2026

ItsecurityguruNews · Aug 19, 2026

Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON - IT Security GuruOpen source ↗

Huntress BlogNews · Aug 19, 2026

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware | HuntressOpen source ↗

Volexity BlogAdvisories · Dec 4, 2025

Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing AttacksOpen source ↗

Talos Intelligence BlogAdvisories · Oct 22, 2017

“Cyber Conflict” Decoy Document Used In Real Cyber ConflictOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

← Back to News