Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
A phishing campaign targeted attendees of Black Hat and DEF CON conferences by impersonating a CoinDesk executive via direct messages. The attackers used a malicious Google Doc with embedded Google Apps Script to deliver malware payloads tailored to the victim's operating system. macOS users were infected with the AMOS infostealer, while Windows users received multiple payloads including NetSupport RAT, a Ledger wallet implant, and a TLS-intercepting proxy. A secondary lure disguised as a DocSend installer delivered additional malware. The campaign leveraged social engineering and trusted platforms to exploit post-conference networking expectations.
AI Analysis
Technical Summary
This threat involves a post-conference phishing campaign that impersonates a CoinDesk VP to target Black Hat and DEF CON attendees through direct messages. The attack uses a malicious Google Doc containing Google Apps Script to present instructions and manual download options. Depending on the victim's OS, different malware payloads are delivered: AMOS infostealer on macOS, and NetSupport RAT, Ledger wallet implant, and TLS-intercepting proxy on Windows. A secondary lure mimics a DocSend installer to deliver further payloads. The campaign demonstrates sophisticated social engineering by exploiting trust and leveraging popular platforms.
Potential Impact
The campaign results in the compromise of victims' systems through malware infections. macOS victims risk data theft via the AMOS infostealer. Windows victims face multiple threats including remote access via NetSupport RAT, cryptocurrency wallet compromise through the Ledger wallet implant, and interception of TLS traffic via a proxy. This can lead to credential theft, unauthorized access, and financial loss. The use of trusted platforms and social engineering increases the likelihood of successful infection.
Mitigation Recommendations
No official patch or fix applies as this is a phishing and malware delivery campaign. Defenders should educate users about phishing risks, especially post-conference social engineering attempts. Users should verify unexpected messages even if they appear to come from trusted contacts. Avoid interacting with unsolicited Google Docs or installers received via direct messages. Employ endpoint protection capable of detecting the described malware families. Monitor for signs of compromise related to AMOS infostealer, NetSupport RAT, and related payloads.
Indicators of Compromise
- domain: docsend.online
- domain: 1foqo.lat
- domain: gapidriver.com
- hash: 281f1d9e0638517ac90d61e47fd8be60
- hash: 6dd77235aaa99153ad790b5e59b49372
- hash: 8ca79bd95f73a7f984b95e487dc1552b
- hash: cd08e22dbfe032d15b54217f4f4ed350
- hash: f4769ba9e8065727ef26cca72e894f83
- hash: f0771f3e97254474ddc518cc99380bd5e267fb10
- hash: 15afe14b5db2896d35a0c4f3139db85158da120fa90613c975c88f10bbbcc420
- hash: e276bf8744f29c54c0a975d98e31e0229cf020bdbb9b8032731aa395b6421c33
- url: http://192.253.248.181/api/v1/getscpt/
- url: http://docsend.online/download/drivers
- url: http://docsend.web12api.com/api/launcher/start
- url: http://eu03hub.com/get_file?file=2Ec6QYynajHw
- url: http://eu03hub.com/get_file?file=T3YxekrHsgfaDdXY
- url: http://eu03hub.com/get_file?file=qV06ev1a1pOY
- url: http://signow.web12api.com/api/launcher/start
- url: https://1foqo.lat/core4
- url: https://1foqo.lat/core4'
- url: https://2fksf.lat/res10.php
- url: https://2fksf.lat/res11.php
- url: https://3pqow.lat/res12.php
- url: https://apple-googleapi.com/i
- url: https://docsend.online/download/drivers
- url: https://docsend.web12api.com/api/launcher/start
- url: https://eu03hub.com/get_file?file=X
- url: https://eu07connect.com/api/commands/
- url: https://gapidriver.com/installer/GapiUpdate.application
- domain: 2fksf.lat
- domain: 3pqow.lat
- domain: apple-googleapi.com
- domain: eu03hub.com
- domain: eu07connect.com
- domain: msedgewebview1.pro
- domain: msedgewebview2.pro
- domain: apple.eu03hub.com
- domain: docsend.web12api.com
- domain: microsoft.eu02hub.com
- domain: signow.web12api.com
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
Description
A phishing campaign targeted attendees of Black Hat and DEF CON conferences by impersonating a CoinDesk executive via direct messages. The attackers used a malicious Google Doc with embedded Google Apps Script to deliver malware payloads tailored to the victim's operating system. macOS users were infected with the AMOS infostealer, while Windows users received multiple payloads including NetSupport RAT, a Ledger wallet implant, and a TLS-intercepting proxy. A secondary lure disguised as a DocSend installer delivered additional malware. The campaign leveraged social engineering and trusted platforms to exploit post-conference networking expectations.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves a post-conference phishing campaign that impersonates a CoinDesk VP to target Black Hat and DEF CON attendees through direct messages. The attack uses a malicious Google Doc containing Google Apps Script to present instructions and manual download options. Depending on the victim's OS, different malware payloads are delivered: AMOS infostealer on macOS, and NetSupport RAT, Ledger wallet implant, and TLS-intercepting proxy on Windows. A secondary lure mimics a DocSend installer to deliver further payloads. The campaign demonstrates sophisticated social engineering by exploiting trust and leveraging popular platforms.
Potential Impact
The campaign results in the compromise of victims' systems through malware infections. macOS victims risk data theft via the AMOS infostealer. Windows victims face multiple threats including remote access via NetSupport RAT, cryptocurrency wallet compromise through the Ledger wallet implant, and interception of TLS traffic via a proxy. This can lead to credential theft, unauthorized access, and financial loss. The use of trusted platforms and social engineering increases the likelihood of successful infection.
Defensive Guidance
No official patch or fix applies as this is a phishing and malware delivery campaign. Defenders should educate users about phishing risks, especially post-conference social engineering attempts. Users should verify unexpected messages even if they appear to come from trusted contacts. Avoid interacting with unsolicited Google Docs or installers received via direct messages. Employ endpoint protection capable of detecting the described malware families. Monitor for signs of compromise related to AMOS infostealer, NetSupport RAT, and related payloads.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.huntress.com/blog/defcon-phishing-google-doc-malware"]
- Adversary
- null
- Pulse Id
- 6a85d24a1bf7db5b97a4e9f8
- Threat Score
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domaindocsend.online | — | |
domain1foqo.lat | — | |
domaingapidriver.com | — | |
domain2fksf.lat | — | |
domain3pqow.lat | — | |
domainapple-googleapi.com | — | |
domaineu03hub.com | — | |
domaineu07connect.com | — | |
domainmsedgewebview1.pro | — | |
domainmsedgewebview2.pro | — | |
domainapple.eu03hub.com | — | |
domaindocsend.web12api.com | — | |
domainmicrosoft.eu02hub.com | — | |
domainsignow.web12api.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash281f1d9e0638517ac90d61e47fd8be60 | — | |
hash6dd77235aaa99153ad790b5e59b49372 | — | |
hash8ca79bd95f73a7f984b95e487dc1552b | — | |
hashcd08e22dbfe032d15b54217f4f4ed350 | — | |
hashf4769ba9e8065727ef26cca72e894f83 | — | |
hashf0771f3e97254474ddc518cc99380bd5e267fb10 | — | |
hash15afe14b5db2896d35a0c4f3139db85158da120fa90613c975c88f10bbbcc420 | — | |
hashe276bf8744f29c54c0a975d98e31e0229cf020bdbb9b8032731aa395b6421c33 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://192.253.248.181/api/v1/getscpt/ | — | |
urlhttp://docsend.online/download/drivers | — | |
urlhttp://docsend.web12api.com/api/launcher/start | — | |
urlhttp://eu03hub.com/get_file?file=2Ec6QYynajHw | — | |
urlhttp://eu03hub.com/get_file?file=T3YxekrHsgfaDdXY | — | |
urlhttp://eu03hub.com/get_file?file=qV06ev1a1pOY | — | |
urlhttp://signow.web12api.com/api/launcher/start | — | |
urlhttps://1foqo.lat/core4 | — | |
urlhttps://1foqo.lat/core4' | — | |
urlhttps://2fksf.lat/res10.php | — | |
urlhttps://2fksf.lat/res11.php | — | |
urlhttps://3pqow.lat/res12.php | — | |
urlhttps://apple-googleapi.com/i | — | |
urlhttps://docsend.online/download/drivers | — | |
urlhttps://docsend.web12api.com/api/launcher/start | — | |
urlhttps://eu03hub.com/get_file?file=X | — | |
urlhttps://eu07connect.com/api/commands/ | — | |
urlhttps://gapidriver.com/installer/GapiUpdate.application | — |
Threat ID: 6a8788a0acd9273b493f8c33
Added to database: 08/20/2026, 23:07:12 UTC
Last enriched: 08/20/2026, 23:25:27 UTC
Last updated: 08/20/2026, 23:51:31 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.