Attackers used a fake crypto conference to target cybersecurity researchers

A routine-looking invitation concealed a carefully designed trap that exploited professional trust and the familiar appearance of Google’s online tools.

An attacker posing as a representative of a well-known cryptocurrency media outlet targeted cybersecurity researchers before and during the Black Hat and Def Con conferences. They used public replies and private messages on the social network X to find potential victims.

Huntress reported the phishing campaign. One of its researchers continued corresponding with the attacker to determine how the scheme worked. Writing in broken English, the interlocutor asked about conference attendance and mentioned an alleged event supposedly organized by a cryptocurrency news website.

A Fake Crypto Conference in Google Docs

After the initial contact, the attacker sent a legitimate Google Docs file presented as a preparation document for a fictitious cryptocurrency conference. It included a sidebar intended to convince the user that the document’s contents were protected by encryption.

The potential victim was asked to enter a supposed decryption key provided by the attacker. This action was meant to trigger the next stage of the attack and lead to the installation of malware.