Hacker reportedly lures security researchers with fake crypto conference via Google Docs malware

This attack demonstrates how adversaries adapt to their targets by leveraging tools commonly used in professional collaboration. Google Docs and Google App Script are trusted platforms, making them effective vectors for social engineering. The attacker’s use of a fake conference, timed around major security events like Black Hat and Def Con, suggests an awareness of researchers’ likely availability and interest in networking opportunities. The campaign’s plausibility was further enhanced by the use of broken English, which may have been intentional to avoid raising suspicion among targets accustomed to interacting with international peers.

The malware delivery mechanism relied on a multi-stage process designed to evade detection. Targets were first prompted to enter a fake decryption key, which likely served as a way to confirm their engagement before delivering the actual payload. The use of Google App Script to customize the document’s sidebar added a layer of legitimacy, as the interface appeared to be a built-in feature rather than an external link or attachment. This approach reduces the likelihood of targets questioning the document’s authenticity, as the malicious components were embedded within a familiar platform.

The payloads varied depending on the target’s operating system, indicating the attacker’s intent to maximize success across different environments. For macOS, an infostealer was deployed, while Windows targets received a repurposed remote desktop tool. The inclusion of a fake Ledger cryptocurrency wallet installer suggests the attacker may have been targeting researchers with an interest in blockchain or crypto security, aligning with the fake conference’s theme. This specificity in payload selection underscores the importance of tailoring defenses to the likely interests and behaviors of high-value targets.

The incident underscores the limitations of relying solely on platform trust for security. While Google Docs is a widely used and generally secure tool, its customization features can be exploited to create convincing phishing lures. Security researchers, despite their expertise, are not immune to such attacks, particularly when the attacker leverages social engineering tactics that exploit professional curiosity and trust. Organizations should consider implementing additional safeguards, such as sandboxing or behavioral analysis, for unsolicited documents shared via collaboration tools, even when they originate from seemingly legitimate sources.