Fake Crypto Conference Lure Used to Target Security Researchers After DEF CON

An unidentified attacker posed as an employee of a leading cryptocurrency news site and used a fake conference as bait to target cybersecurity professionals around the Black Hat and DEF CON conferences in early August 2026. The campaign, detailed by security firm Huntress in a blog post published August 19, lured targets via social media platform X and used legitimate Google Docs infrastructure to deliver malware (TechCrunch, Huntress).

The attacker approached conference attendees through both public replies and direct messages on X. According to Huntress, one of its researchers played along with the ruse to learn what the attacker was attempting. The hacker, writing in broken English, asked the researcher about their conference plans and then referenced a conference allegedly organized by the crypto news outlet.

The lure itself was a legitimate Google Doc styled to look like a planning document for the fictitious conference. Using Google Apps Script, the platform that lets developers add custom menus and sidebars to Google Docs, the attacker injected a fake encryption sidebar designed to convince the target that the document was secured. The first step of compromise was prompting the victim to enter a decryption key supplied by the attacker. Entering that key initiated a process that delivered different payloads depending on the victim's operating system.

On macOS, the attacker attempted to deploy an infostealer identified as AMOS. On Windows, the payload was NetSupport RAT, a remote desktop tool repurposed as remote access malware. The attacker also tried to push a trojanized installer for the Ledger cryptocurrency wallet. The combination of infostealer, RAT, and wallet-trojan payloads suggests the campaign was designed for both credential theft and direct fund theft.

The X account associated with the attacker, @HartmansDoeke, did not respond when TechCrunch sent a private message. Google also did not immediately respond to TechCrunch's inquiry about whether the company had observed this campaign or similar ones.

What sets this operation apart from earlier targeting of security researchers is its abuse of trusted, widely used infrastructure. TechCrunch noted that using a genuine Google Doc and Google's own Apps Script features made the lure more convincing than prior campaigns by nation-state actors, including North Korean operators who used fabricated Twitter profiles to approach researchers.

The broader context here is a sustained escalation in social engineering aimed at the crypto-adjacent and security communities. SentinelLABS documented a suspected DPRK threat actor under the BlueNoroff cluster delivering multi-stage macOS malware via fake crypto news outlets, with novel persistence techniques (SentinelOne). SC World, citing The Hacker News, reported a newly tracked actor designated JINX-0164 targeting crypto organizations with sophisticated macOS malware (SC World). In March, developers were being targeted through GitHub phishing that impersonated the OpenClaw project with fake token airdrops (CoinDesk). Cyware's August 17 daily briefing flagged LinkedIn outreach using fake technical assessments to drain cryptocurrency wallets (Cyware).

The scale metrics reinforce the trajectory. Chainalysis reported a 1,400% year-over-year increase in impersonation scams in 2025, with AI-enabled scams proving 450% more profitable than traditional ones (CoinDesk). And on August 16, crypto wallet maker SafePal disclosed a data breach exposing order information for nearly 40,000 customers, including names, physical addresses, and contact details — a trove tailor-made for follow-on phishing and impersonation (CoinDesk).

The Huntress findings are notable for what they reveal about the attacker's tradecraft rather than their sophistication. The campaign's effectiveness depended entirely on trust transfer: a recognized brand name for the crypto site, a legitimate Google Docs URL, and a conference context that gave the outreach plausibility. The Apps Script sidebar was not a zero-day or an exploit. It was a feature used as designed, repurposed for deception. For security teams, the takeaway is that the perimeter now includes the social platforms and collaboration tools their researchers use daily, not just the endpoints those researchers harden.

Worth flagging: the targeting of security professionals at their own conferences is a calculated move. These are individuals who, by professional disposition, are primed to investigate suspicious activity — the same instinct that led the Huntress researcher to engage rather than ignore. An attacker who can convert a researcher's curiosity into a click has turned a defensive reflex into an attack vector. The community should weigh whether the default response to suspicious outreach at conferences needs to shift from engagement to immediate reporting.