Phishing After the Conference: A New Threat
Cybersecurity conferences like Def Con and Black Hat are prime hunting grounds for threat actors. A new report from Huntress reveals a persistent phishing campaign targeting attendees after the events.
Published on August 19, the blog details how a Huntress researcher was targeted on X (formerly Twitter) following this summer’s Black Hat / Def Con. The attacker posed as CoinDesk’s VP of marketing, asking for help with a fictitious conference.
The researcher spotted the scam but played along to understand the tactics. What followed was a multi-stage attack using trusted platforms to build credibility.
The Google Doc Lure: More Than a Simple Phish
The first lure was a Google Doc disguised as a planning document. But it wasn’t your typical phishing page.
“The Google Doc was more than your typical phishing lure leading to a malicious web page. If an authenticated Google user opened it, a custom Google Apps Script sidebar was presented alongside the document,” Huntress explained.
The document asked for an ‘encryption key’ supplied by the actor in DMs. When it failed, the sidebar offered two options: ClickFix-style instructions and a download. Both were designed to execute malicious code.
This is a classic ClickFix attack pattern, where victims are tricked into running commands that bypass security controls.
A Persistent Scammer: Pivoting to Dropbox and Malware
The researcher didn’t fall for it. But the actor didn’t give up. The next day, they sent a Dropbox DocSend link leading to a counterfeit installer.
The installer was versatile, delivering different payloads based on the victim’s OS:
- macOS: The AMOS infostealer, designed to steal credentials and sensitive data.
- Windows: An implant targeting Ledger wallets to steal cryptocurrency, plus a proxy to evade VirusTotal checks.
“Taken together, the two lures show how the threat actor used familiar platforms to build credibility and keep the target engaged,” Huntress noted. By combining social media DMs with trusted services, they created a legitimate-looking workflow.
When that failed, the actor pivoted again, asking if the researcher knew anyone wanting up to $1m in funding. This was likely another pretext to steal credentials or PII.
How to Protect Yourself After a Conference
Huntress advises conference-goers to be wary of legitimate-looking messages that lead to documents or installers requiring unusual actions.
“Unexpected requests to run terminal commands, bypass Gatekeeper, install a manual update, or enter a device password are all strong indicators of an attempt to compromise,” the report concluded.
If you’ve interacted with such a message, Huntress recommends:
- Isolate the system from the network immediately.
- Collect forensic evidence and consider reimaging the system.
- Assume credentials have been compromised.
- Revoke active sessions, reset passwords, and rotate API keys.
- Review cryptocurrency wallets if relevant.
Staying vigilant after conferences is crucial. Attackers prey on the post-event excitement and trust. Always verify unexpected requests through a separate channel.
