Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

A malicious campaign impersonating crypto marketing personnel used legitimate Google Docs with bound Apps Script to collect victim IPs, detect crypto wallets, and serve OS-specific payloads: a macOS AMOS infostealer via piped zsh or DMG, and a Windows PowerShell loader that deployed encrypted payloads (NetSupport RMM, a malicious local proxy/rogue CA, and a Ledger wallet implant). The Windows chain abused at least three stolen or fraudulent code-signing certificates and implemented novel tradecraft including MSBuild hollowing, local CA installation to intercept TLS, fake progress UIs, and persistence via RMM tooling; mitigation recommendations include opening unknown documents while signed out and full reimaging to remove rogue CAs.