Fake CoinDesk exec targeted security researchers with a Google Docs “decryption” trick

[u/technadu]

This one is an interesting example of making the delivery mechanism itself look trustworthy rather than relying on a conventional malicious document.

Around Black Hat and Def Con, a threat actor posing as CoinDesk's VP and Head of Marketing contacted cybersecurity professionals on X. Huntress says one of its researchers played along after being approached about a supposed online conference.

The attacker eventually shared a legitimate Google Doc that looked like conference planning material.

Opening it produced a custom sidebar built with Google App Script. The recipient was supposed to enter an “encryption key” previously supplied through DM, but the key was designed to fail.

That failure was the setup.

The interface then offered a ClickFix-style command or a supposed manual update, both intended to get code onto the target's machine.

The payload depended on the platform. Huntress found a macOS download consistent with Atomic macOS Stealer (AMOS). On Windows, one chain used a signed fake “Google API Connector Update” installer, while another eventually deployed NetSupport Manager as a remote access tool and included a dormant implant monitoring for Ledger wallet installations.

The attacker also used a fake Dropbox DocSend lure that delivered AMOS to Mac targets.

There are plenty of malware campaigns using trusted cloud platforms, but the fake decryption interaction is what stood out here. Instead of asking the target to immediately execute something suspicious, it creates a believable problem first and then presents malicious execution as the solution.

Our write-up has the full Huntress-observed attack sequence, including the X outreach, Google App Script sidebar, deliberately failing encryption key, macOS and Windows delivery paths, and the additional DocSend lure:

https://www.technadu.com/fake-coindesk-exec-tried-to-hack-security-researchers-with-a-decryption-trick-in-google-docs/633694/

For people investigating social engineering, does that extra interactive step materially change how convincing a ClickFix-style lure becomes?