How a Hacker Used a Fake Crypto Conference to Trick Cybersecurity Experts
An unidentified attacker pretended to work for a major cryptocurrency news website and invented a fake conference to trick cybersecurity professionals during the Black Hat and DEF CON conferences in early August 2026. Security firm Huntress described the campaign in an August 19 blog post, explaining how the attacker used the social media platform X and real Google Docs to deliver harmful software (TechCrunch, Huntress).
The attacker reached out to conference attendees through public replies and private messages on X. According to Huntress, one of its researchers played along to find out what the attacker was really after. The hacker, writing in broken English, asked the researcher about their conference plans and then mentioned a conference supposedly run by the crypto news site.
The bait was a real Google Doc designed to look like a planning document for the made-up conference. The attacker used Google Apps Script, a tool Google provides for adding extra features to documents, to create a fake security sidebar that made the document look like it was password-protected. The trap was triggered when the victim entered a decryption key given to them by the attacker. That set off a process that installed different harmful software depending on whether the victim was using a Mac or a Windows PC.
On Mac computers, the attacker tried to install a program called AMOS, which secretly steals saved passwords and personal information. On Windows, the attacker used a tool called NetSupport RAT, originally designed for legitimate remote computer access but repurposed to take control of the victim's computer. The attacker also tried to deliver a tampered version of the Ledger cryptocurrency wallet app. The combination of these three tools suggests the campaign was designed to steal both login credentials and actual cryptocurrency funds.
The X account used by the attacker, @HartmansDoeke, did not respond when TechCrunch sent a private message. Google also did not immediately respond to TechCrunch's question about whether the company had seen this campaign or similar ones.
What makes this operation different from earlier attacks on security researchers is its use of trusted, everyday tools. TechCrunch noted that using a real Google Doc with Google's own features made the bait more convincing than earlier efforts by nation-state hackers, including North Korean operatives who used fake Twitter profiles to approach researchers.
The broader context here is a steady increase in scams aimed at people in the cryptocurrency and cybersecurity fields. SentinelLABS documented a suspected North Korean hacking group called BlueNoroff delivering Mac malware through fake crypto news websites (SentinelOne). SC World, citing The Hacker News, reported a newly identified hacking group called JINX-0164 targeting crypto companies with sophisticated Mac malware (SC World). In March, developers were targeted through a phishing scam on GitHub that impersonated a project called OpenClaw and offered fake cryptocurrency giveaways (CoinDesk). Cyware's August 17 daily briefing noted scammers using LinkedIn to approach people with fake technical assessments designed to drain their crypto wallets (Cyware).
The scale of the problem has grown sharply. Chainalysis reported a 1,400% year-over-year increase in impersonation scams in 2025, with AI-enabled scams proving 450% more profitable than traditional ones (CoinDesk). On August 16, crypto wallet maker SafePal disclosed a data breach that exposed order information for nearly 40,000 customers, including names, addresses, and contact details — exactly the kind of information that makes follow-on phishing and impersonation easier (CoinDesk).
The Huntress findings are notable for what they reveal about the attacker's methods rather than their technical skill. The campaign worked because it borrowed trust from recognizable sources: a known brand name, a real Google Docs link, and a conference setting that made the outreach seem believable. The Google feature used to create the fake security sidebar was not a software vulnerability being exploited. It was a normal feature working as intended, just used dishonestly. For security teams, the lesson is that the threats now live on the social platforms and collaboration tools their researchers use every day, not just on the computers those researchers protect.
In this author's view, the decision to target security professionals at their own conferences is deliberate. These are people whose professional instinct tells them to investigate something suspicious — the same instinct that led the Huntress researcher to engage with the attacker rather than ignore the message. An attacker who can turn a researcher's curiosity into a click has flipped a defensive habit into a way in. The community may need to reconsider whether the right response to suspicious outreach at conferences is to engage and investigate, or to report it immediately and move on.
