Full Report
Huntress researcher uncovers post-Black Hat & DEF CON phishing campaign using X DMs & malicious documents to deliver AMOS, NetSupport RAT, and other malware.
Analysis Summary
# Incident Report: Post-DEF CON Phishing & Google Apps Script Malware Delivery
## Executive Summary
Following the Black Hat and DEF CON 2026 conferences, a threat actor launched a targeted phishing campaign using social media DMs and malicious Google Docs to deliver multiple malware strains. The attack utilized advanced "ClickFix" social engineering and custom Google Apps Scripts to deploy AMOS (Atomic Stealer) on macOS and NetSupport RAT on Windows. The incident highlights a sophisticated pivot from simple phishing to using trusted cloud app environments (Google Workspace/Dropbox) to bypass traditional security filters.
## Incident Details
- **Discovery Date:** August 19, 2026 (Report Publication)
- **Incident Date:** Began August 9, 2026
- **Affected Organization:** Multiple (targeted attendees of Black Hat/DEF CON)
- **Sector:** Cybersecurity / Technology
- **Geography:** Global (targeting conference attendees)
## Timeline of Events
### Initial Access
- **Date/Time:** August 9, 2026
- **Vector:** Social Media (X/Twitter) Direct Messages.
- **Details:** The threat actor (@HartmansDoeke) posed as a CoinDesk executive, using a mix of legitimate names and photos to build trust. They invited the target to collaborate on a conference project, providing a link to a Google Doc.
### Lateral Movement
- **Details:** While the report focuses on the initial compromise of the endpoint, the delivery of NetSupport RAT and a polling backdoor (`com.xdivcmp.plist`) indicates the attackers intended to maintain long-term access for potential lateral movement or persistent monitoring.
### Data Exfiltration/Impact
- **Details:**
- **macOS:** Execution of AMOS (Atomic Stealer) targeted keychain data, browser credentials, and local files.
- **Windows:** Deployment of a Ledger wallet implant and a traffic-intercepting proxy, targeting cryptocurrency and sensitive network traffic.
### Detection & Response
- **Detection:** A Huntress researcher identified the X DM as a scam and engaged in "active defense" to analyze the infrastructure.
- **Response Actions:** The researcher isolated the malware, reverse-engineered the Google Apps Script, and documented the C2 communication to generate the published IOC list.
## Attack Methodology
- **Initial Access:** Social Engineering via X DMs leading to a Google Doc with a malicious Sidebar.
- **Persistence:** On macOS, a LaunchDaemon (`com.xdivcmp.plist`) was used for a polling backdoor. On Windows, NetSupport RAT was deployed.
- **Defense Evasion:** Use of Google Apps Script to run code within a "trusted" Google domain; ClickFix techniques to trick users into manually running PowerShell/Terminal commands to bypass OS protections.
- **Credential Access:** AMOS infostealer (macOS) and Ledger wallet implants (Windows).
- **Collection:** Automated staging of stolen data in `/tmp/lksopo` (macOS).
- **Exfiltration:** Data sent to remote panel hosts (`86.54.25[.]213`).
- **Impact:** Complete compromise of the endpoint, theft of crypto-assets, and credential harvesting.
## Impact Assessment
- **Financial:** High potential for loss due to targeted Ledger wallet implants and crypto-draining capabilities.
- **Data Breach:** Compromise of browser-stored passwords, system metadata, and session tokens.
- **Operational:** System compromise requires full reimaging and password rotation across the organization.
- **Reputational:** Exploitation of high-profile industry events (Black Hat/DEF CON) to target security professionals.
## Indicators of Compromise
### Network Indicators
- `apple-googleapi[.]com`
- `apple.eu03hub[.]com`
- `docsend[.]online`
- `86.54.25[.]213`
- `192.253.248[.]181`
### File Indicators
- `GAPIUpdate.dmg`
- `15afe14b5db2896d35a0c4f3139db85158da120fa90613c975c88f10bbbcc420` (SHA-256)
- `/Library/LaunchDaemons/com.xdivcmp.plist`
## Response Actions
- **Containment:** Isolate affected hosts from the network immediately.
- **Eradication:** Reimage infected systems; the presence of backdoors makes simple file deletion insufficient.
- **Recovery:** Revoke all active sessions, reset all corporate and personal passwords, and rotate API keys/secrets.
## Lessons Learned
- **Trust as a Vector:** Attackers are effectively leveraging the "networking" culture of professional conferences to lower victim guards.
- **Scripted Document Risks:** Google Apps Script can be weaponized to create convincing, interactive malware delivery interfaces that do not trigger standard URL filters.
- **Cross-Platform Targeting:** The actor maintained separate, tailored infection chains for both macOS and Windows, showing a high level of preparation.
## Recommendations
- **User Training:** Educate staff on "ClickFix" lures—specifically, that legitimate documents will never ask a user to paste commands into a Terminal or PowerShell prompt.
- **Technical Controls:** Restrict the execution of unassigned scripts and monitor for unusual GitHub download activity or connections to unauthorized C2 IPs.
- **Credential Hygiene:** Implement hardware MFA (Security Keys) to mitigate the impact of stolen session tokens and passwords.