A researcher at Huntress, a cybersecurity company that helps businesses detect and respond to hacking attempts, faced a persistent phishing campaign after attending cybersecurity conferences this summer, with an attacker impersonating an executive from CoinDesk, a media outlet that covers the cryptocurrency industry, to push malicious documents and a fake installer which is a file disguised to look like it would install a legitimate program, but which actually installs malware, over several days.

 

What happened

A threat actor posing as CoinDesk's VP and head of marketing contacted the Huntress researcher on X after cybersecurity conferences. The actor first requested help with a fictitious upcoming conference, then sent a Google Doc disguised as a planning document. Opening the document triggered a pop-up sidebar panel built with Google Apps Script, a tool that lets someone add custom buttons, forms, and pop-ups to a Google Doc, similar to how a plug-in adds extra features to an app. The panel asked the user to enter an "encryption key" supplied by the actor.

The key appeared to fail, and the panel then offered two follow-on options designed to get the victim to run malicious code themselves. One of these followed the pattern of "ClickFix," a scam tactic where a fake error message or pop-up instructs the victim to copy and paste a command into their own computer's terminal (a text-based tool for issuing commands directly to the operating system) to "fix" the problem, when in reality, the pasted command installs malware. The other option was a direct download link. The researcher recognized the scam and did not comply, but stayed engaged to observe the tactics.

 

Going deeper

The actor returned the next day with a second lure disguised as a Dropbox DocSend share (DocSend is a document-sharing service commonly used for business proposals), leading to a fake installer.

The installer delivered different malware depending on the victim's operating system, an information-stealing program called AMOS on Mac computers, and on Windows computers, malware built to steal cryptocurrency from Ledger wallets (a popular brand of hardware device used to store cryptocurrency), along with a tool meant to help the malware slip past antivirus programs and other security checks.

After the document and installer attempts failed, the actor tried again, asking the researcher if they knew anyone seeking funding of up to $1 million, which Huntress suggested could be another attempt to harvest credentials or personal information.

 

What was said

Huntress described the Google Doc lure as going beyond a normal phishing page, noting that "if an authenticated Google user opened it, a custom Google Apps Script sidebar was presented alongside the document." Huntress also said the sidebar's two follow-on options were "intended to download and execute malicious code."

On the two lures together, Huntress said the actor combined social platforms to appear credible, "The threat actor used familiar platforms to build credibility and keep the target engaged."

Huntress also flagged warning signs for conference attendees, stating that "unexpected requests to run terminal commands, bypass Gatekeeper, install a manual update, or enter a device password are all strong indicators of an attempt to compromise."

 

Why it matters

Healthcare organizations send staff to security-focused conferences too. Black Hat now runs an inaugural Healthcare Summit alongside its main event, and HIMSS (a healthcare technology organization) hosts its own Healthcare Cybersecurity Forum, meaning hospital CISOs (chief information security officers, the executives responsible for protecting a company's data and systems), IT leaders, and clinical security staff attend exactly the kind of conferences this attacker was exploiting. A healthcare employee who attended Black Hat, Def Con, or a HIMSS event and later gets a friendly follow-up message on social media is in the same position the Huntress researcher was in, except a successful compromise on their end could expose systems holding patient records.

 

The bottom line

This case is a reminder that multi-stage social engineering, spread across direct messages, a document, and a fake installer, is now standard tradecraft, not a one-off scheme. A similar pattern has already shown up in a LinkedIn campaign where attackers used fake board-member invitations and lookalike "cloud share" (fake versions of familiar file-sharing links, like a Google Drive or Dropbox share, designed to trick someone into thinking they're opening a real document) pages to steal executive credentials, showing the approach isn't limited to security researchers or any single industry. Anyone who has interacted with an unsolicited message leading to a document or installer, especially one asking to bypass normal security controls like entering a password or running terminal commands (typed instructions given directly to a computer's operating system, usually copied and pasted from instructions the attacker provides), should treat it as a possible compromise and verify before taking further action.

Read also: The credential-theft fake reporter scam on X

 

FAQs

What is an infostealer?

An infostealer is a type of malware designed to quietly collect sensitive data, such as saved passwords, browser cookies, or cryptocurrency wallet credentials, from an infected device.

 

What is ClickFix?

ClickFix is a social engineering technique that tricks a user into copying and pasting attacker-supplied commands into their own computer, making the victim unknowingly execute the malicious code themselves.

 

What is a hardware wallet, and why did the malware target Ledger specifically?

A hardware wallet is a physical device that stores the private keys needed to access cryptocurrency, kept offline for extra security. Ledger is one of the most widely used brands, which makes it a common target for malware designed to intercept or steal those keys.