Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

Huntress researchers investigated a post-conference phishing campaign that used X (Twitter) DMs and trusted document/file-sharing services to distribute weaponized Google Docs and counterfeit DocSend installers; the lures delivered macOS AMOS stealer and multiple Windows payloads (NetSupport RAT, a TLS‑intercepting local proxy via a forged CA, and a Ledger wallet implant). The report details the attacker workflow, payload behaviors, persistence mechanisms, C2 infrastructure, indicators of compromise, and recommended mitigations.