Cybersecurity Experts Targeted in Fake Conference Scam

Targeting cybersecurity professionals often ends unsuccessfully for hackers, as members of this group are skilled at quickly exposing any attack. Nevertheless, unknown attackers recently tried to deceive several experts under the guise of a fake cryptocurrency event ahead of the major Black Hat and Def Con security conferences in the United States. This was reported by TechCrunch.com .

According to TechCrunch and security firm Huntress, the scammer posed as an employee of a leading crypto news site and searched for victims through the X social media platform, formerly Twitter. The attacker contacted potential targets through public replies and direct messages (DMs), attempting to persuade them to install malware using Google Docs documents.

Fake Event and Sophisticated Trap

According to details published by Huntress specialists, one company employee noticed the suspicious activity and continued engaging with the scammers to investigate their true intentions. Writing in broken English, the attacker asked about plans to attend the event and mentioned a private conference supposedly organized by a well-known crypto resource.

During the ensuing conversation, the attacker sent a legitimate Google Docs link presented as a planning document for the fake conference. The document displayed a special sidebar claiming that it was encrypted and protected, in an attempt to deceive the user. The main goal was to force the target to enter a fake encryption key supplied by the scammer.

Methods Used to Distribute Malware

According to Huntress’s analysis, entering the key was the first step in a process that led to the installation of malware designed for macOS or Windows, depending on the operating system used by the victim. The attacker used the Google App Script platform to make the sidebar appear trustworthy. It allows developers to customize the Google Docs interface with menus and panels.

During the attack, the hacker attempted to deliver the following malicious tools:

• An infostealer designed for Apple computers
• A specially modified remote desktop monitoring tool for Windows
• A fake installer for the Ledger cryptocurrency wallet

It emerged that the account owner who organized the campaign did not respond to TechCrunch’s request for comment. Although state-sponsored hackers and North Korean groups have previously targeted cybersecurity professionals, this attempt appeared somewhat more convincing because it used legitimate Google services and documents. Google has not yet issued an official statement about the incident or similar campaigns.