Someone targeted security researchers using a fake crypto conference as a lure

Researchers observed a targeted phishing campaign that impersonated a crypto news outlet on X to lure cybersecurity professionals into a legitimate-looking Google Doc. The attacker used Google Apps Script to present a fake encrypted sidebar prompting a decryption key, which would lead to installation of platform-specific malware (an infostealer for macOS, a repurposed remote desktop tool for Windows, and a fake Ledger wallet installer). Huntress documented the interaction with one of its researchers and highlighted the campaign's social-engineering technique leveraging legitimate Google Docs functionality.