Hackers Used a Fake Crypto Conference and Real Google Docs to Target Security Professionals
An unidentified attacker pretended to work for a major cryptocurrency news site and invented a fake conference to lure cybersecurity professionals around the Black Hat and DEF CON conferences in early August 2026. Security firm Huntress detailed the campaign in an August 19 blog post, describing how the attacker used social media platform X and legitimate Google Docs infrastructure to deliver malware (TechCrunch, Huntress).
The attacker contacted conference attendees through both public replies and direct messages on X. According to Huntress, one of its researchers went along with the scheme to learn what the attacker was after. The hacker, writing in broken English, asked the researcher about their conference plans and then mentioned a conference supposedly organized by the crypto news outlet.
The lure was a real Google Doc styled to look like a planning document for the fictitious conference. The attacker used Google Apps Script — a built-in platform that lets developers add custom menus and sidebars to Google Docs — to inject a fake encryption sidebar, making the document appear to be secured. The first step of compromise came when the victim was prompted to enter a decryption key provided by the attacker. Entering that key triggered a process that delivered different malware depending on the victim's operating system.
On macOS, the attacker tried to deploy an infostealer (malware designed to steal saved passwords and other sensitive data) known as AMOS. On Windows, the payload was NetSupport RAT, a legitimate remote desktop tool repurposed as remote access malware. The attacker also attempted to push a tampered installer for the Ledger cryptocurrency wallet. The combination of infostealer, RAT (remote access trojan), and wallet-trojan payloads indicates the campaign was built for both credential theft and direct fund theft.
The X account associated with the attacker, @HartmansDoeke, did not respond when TechCrunch sent a private message. Google also did not immediately respond to TechCrunch's inquiry about whether the company had observed this campaign or similar ones.
What sets this operation apart from earlier targeting of security researchers is its abuse of trusted, widely used infrastructure. TechCrunch noted that using a genuine Google Doc and Google's own Apps Script features made the lure more convincing than prior campaigns by nation-state actors, including North Korean operators who used fabricated Twitter profiles to approach researchers.
The broader context here is a sustained escalation in social engineering aimed at the crypto-adjacent and security communities. SentinelLABS documented a suspected DPRK threat actor under the BlueNoroff cluster delivering multi-stage macOS malware via fake crypto news outlets, using novel persistence techniques (SentinelOne). SC World, citing The Hacker News, reported a newly tracked actor designated JINX-0164 targeting crypto organizations with sophisticated macOS malware (SC World). In March, developers were targeted through GitHub phishing that impersonated the OpenClaw project with fake token airdrops (CoinDesk). Cyware's August 17 daily briefing flagged LinkedIn outreach using fake technical assessments to drain cryptocurrency wallets (Cyware).
The scale metrics reinforce the trajectory. Chainalysis reported a 1,400% year-over-year increase in impersonation scams in 2025, with AI-enabled scams proving 450% more profitable than traditional ones (CoinDesk). And on August 16, crypto wallet maker SafePal disclosed a data breach exposing order information for nearly 40,000 customers, including names, physical addresses, and contact details — a trove well-suited for follow-on phishing and impersonation (CoinDesk).
The Huntress findings are notable for what they reveal about the attacker's tradecraft rather than their sophistication. The campaign's effectiveness depended entirely on trust transfer: a recognized brand name for the crypto site, a legitimate Google Docs URL, and a conference context that gave the outreach plausibility. The Apps Script sidebar was not a zero-day or an exploit — it was a feature used as designed, repurposed for deception. For security teams, the takeaway is that the perimeter now includes the social platforms and collaboration tools their researchers use daily, not just the endpoints those researchers harden.
Worth flagging: the targeting of security professionals at their own conferences is a calculated move. These are individuals who, by professional disposition, are primed to investigate suspicious activity — the same instinct that led the Huntress researcher to engage rather than ignore. An attacker who can convert a researcher's curiosity into a click has turned a defensive reflex into an attack vector. The community should weigh whether the default response to suspicious outreach at conferences needs to shift from engagement to immediate reporting.
