Someone targeted security researchers using a fake crypto conference as a lure

If you are a malicious hacker, cybersecurity professionals whitethorn precise good beryllium the worst radical successful the satellite to effort to hack, arsenic determination is simply a precise bully accidental they are going to drawback you.

A idiosyncratic pretending to enactment for a starring crypto quality tract targeted respective cybersecurity professionals astir the clip of the hacking conferences Black Hat and Def Con earlier this month. The hacker approached attendees connected societal media tract X, some via nationalist replies and DMs, and past leveraged Google Docs successful an effort to instrumentality the targets into installing malware, according to researchers. 

On Wednesday, information steadfast Huntress published a blog post detailing the hacking campaign, which targeted 1 of its researchers, who pretended to spell on with it to larn what the hacker was trying to do. 

In breached English, the hacker asked the researcher if they had plans to be a league next, and past mentioned a league allegedly organized by the crypto quality website, according to a screenshot of the conversation.

After that, the hacker shared a morganatic Google Doc that looked similar it was a readying papers for the fake conference. The papers displayed a sidebar designed to marque the people deliberation it was encrypted. The extremity was to archetypal instrumentality the people into entering a fake decryption cardinal provided by the hacker. That was the archetypal measurement successful a process that would pb to the installation of malware for macOS and Windows, depending connected the operating strategy utilized by the target, according to Huntress.

To marque the sidebar look real, the hacker utilized Google App Script, a level that allows developers to customize the idiosyncratic interface of Google Docs with menus and sidebars, for example.

A screenshot of the Google Doc sent by the hacker to the Huntress researcher.Image Credits:Huntress/Screenshot

The hacker tried to instrumentality Huntress’ researcher into installing an infostealer for Apple computers; a distant desktop viewing instrumentality repurposed arsenic malware for Windows; and a fake installer for the cryptocurrency wallet Ledger.  

The person down the relationship identified by Huntress researchers arsenic the hacker did not respond erstwhile TechCrunch sent them a backstage connection connected X. 

Hackers of each kinds — beryllium them unknown authorities hackers utilizing precocious spyware, oregon North Korean government hackers utilizing fake Twitter profiles — person targeted cybersecurity professionals before. What made this run a spot much believable was the usage of a morganatic Google Doc and Google feature. 

Google did not instantly erstwhile TechCrunch reached retired asking if the institution had seen this hacking campaign, oregon akin ones.