Cybersecurity researchers were recently targeted by a sophisticated phishing campaign in which attackers used a fake cryptocurrency conference as bait.

The campaign emerged around the Black Hat and Def Con security conferences and involved an individual posing as a representative of a well known cryptocurrency news organization.

Researchers said the attacker contacted cybersecurity professionals through the social media platform X, using both public replies and private messages.

Targets were then directed to a Google document that appeared to contain information about an upcoming conference.

The document was designed to look legitimate and included features intended to convince victims that the material was protected by encryption.
According to security company Huntress, the attacker attempted to persuade targets to enter a fake decryption key before directing them toward malicious software.

The campaign was designed to work against both Mac and Windows users, with different forms of malicious software being offered depending on the victim’s operating system.

The attacker used Google Apps Script to make the fake document appear more convincing.

Researchers identified several malicious tools involved in the campaign. This includes information stealing software aimed at Mac users, a remote desktop program modified for malicious purposes on Windows; and a fraudulent installer disguised as software for the Ledger cryptocurrency wallet.

Cybersecurity professionals are frequent targets of sophisticated attacks because of the sensitive information and systems they may have access to.
What made this campaign particularly convincing was the use of a genuine Google document and legitimate Google features.

The incident highlights the importance of carefully verifying invitations, links, software downloads and conference communications, even when they appear to come from familiar organizations.

Source:Techcrunch