Skip to content

Back to the catalog

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
huntress.comwriteup

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

TL;DR Huntress dissects a crypto-lure Google Doc/Apps Script campaign that drops AMOS on macOS and, on Windows, chains three stolen code-signing certs into NetSupport Manager abuse, a Ledger implant, and a rogue self-signed CA for TLS interception.
Open original ↗

Organisations named here

  • ClickFix
  • eu03hub[.]com
  • GTA6Mainserver[.]com
  • GTA6Mainweb[.]com
  • Lenovo
  • web12api[.]com

Technologies named here

  • macOS
  • Huntress
  • Tradecraft Tuesday
  • Windows
  • Telegram API
  • Google Docs / Google Apps Script
  • Google Workspace Marketplace
  • VirusTotal
  • Dropbox DocSend
  • @sentry/electron module
  • MetaMask / Ethereum wallets
  • SignNow
  • Phantom wallet
  • ClickOnce
  • Tron wallet
  • PowerShell
  • MSBuild.exe
  • Solana wallet
  • Ledger Live / Ledger Wallet
  • Norwegian company code-signing certificate
  • Discord Inc. code-signing certificate
  • Lenovo code-signing certificate
  • Google Workspace
  • Telegram
  • Discord

Techniques named here

  • ClickFix lure
  • Container-bound Google Apps Script abuse
  • Social engineering via impersonation
  • OS fingerprinting and path branching
  • Code-signing certificate abuse
  • Gatekeeper bypass
  • Living-off-the-land via ClickOnce
  • Distraction UI / fake progress indicators
  • Silent failure / error suppression
  • Infrastructure reconstruction from dead endpoint
  • Password-protected archive delivery
  • RMM tool abuse for persistence and C2
  • Process hollowing
  • Steganographic bot ID hiding
  • Pre-execution reconnaissance screenshot

Threat actors named here

  • @HartmansDoeke
  • AMOS Stealer
  • MacSync Stealer
  • NetSupport Manager
  • Rogue Certificate Authority payload
  • Ledger wallet implant
  • GTA6Mainserver[.]com / GTA6Mainweb[.]com lure
  • MacSync

Related in Threat Intel