Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

This threat involves a post-conference phishing campaign that impersonates a CoinDesk VP to target Black Hat and DEF CON attendees through direct messages. The attack uses a malicious Google Doc containing Google Apps Script to present instructions and manual download options. Depending on the victim's OS, different malware payloads are delivered: AMOS infostealer on macOS, and NetSupport RAT, Ledger wallet implant, and TLS-intercepting proxy on Windows. A secondary lure mimics a DocSend installer to deliver further payloads. The campaign demonstrates sophisticated social engineering by exploiting trust and leveraging popular platforms.

The campaign results in the compromise of victims' systems through malware infections. macOS victims risk data theft via the AMOS infostealer. Windows victims face multiple threats including remote access via NetSupport RAT, cryptocurrency wallet compromise through the Ledger wallet implant, and interception of TLS traffic via a proxy. This can lead to credential theft, unauthorized access, and financial loss. The use of trusted platforms and social engineering increases the likelihood of successful infection.

No official patch or fix applies as this is a phishing and malware delivery campaign. Defenders should educate users about phishing risks, especially post-conference social engineering attempts. Users should verify unexpected messages even if they appear to come from trusted contacts. Avoid interacting with unsolicited Google Docs or installers received via direct messages. Employ endpoint protection capable of detecting the described malware families. Monitor for signs of compromise related to AMOS infostealer, NetSupport RAT, and related payloads.