Def Con Attendees Targeted by Persistent Phishing Campaign

Huntress warns conference attendees about a targeted phishing campaign that used impersonation, malicious Google Docs (with a custom Apps Script sidebar), and fake DocSend installers to deliver malware — including the AMOS infostealer for macOS and a Windows implant that steals Ledger cryptocurrency and uses a proxy to evade detection — and advises isolating affected systems, collecting forensics, rotating credentials and secrets, and reviewing cryptocurrency wallets.