An attacker posing as a CoinDesk executive is targeting attendees of “Hacker Summer Camp” in a social engineering campaign that leads to installation of macOS and Windows malware,
Huntress reported Wednesday.
A Huntress researcher was contacted by an X account with the handle "@HartmansDoeke," who claimed to be the vice president and head of marketing for CoinDesk. Huntress noted that the account was replying to several users who had attended Black Hat or DEF CON, asking to connect.
The researcher, recognizing the scam, continued to communicate with the account to gain more information; the attacker claimed to be planning an upcoming conference and sent a Google document presented as a planning document for the event.
Reconnaissance starts once Google Doc is opened
When the document is opened by a user logged in to their Google account, a Google Apps Script loads a sidebar prompting the user to enter a “decryption key” provided by the attacker to view the full document.
“Google Apps Script is a built-in Javascript platform able to hook into any product in the G-Suite. A script can be ‘container-bound’ to a specific Doc, meaning it ships with the document and travels with it when shared,” Huntress Principal Security Operations Analyst Jonathan Semon explained in an email to SC Media. “Through HtmlService that script can render arbitrary HTML, CSS and JavaScript as a sidebar panel inside the Docs UI, in a sandboxed iframe.”
In this case, as soon as a logged-in user opens the attacker’s Google Doc, the “DecryptPanel.html” sidebar collected victim host information, including IP address and operating system. Semon told SC Media the attacker’s Google Apps Script code included calls to ipify[.]org and ipapi[.]co, both popular fingerprinting services.
“We can see from the code the full list of items they are searching for: OS, public IP, city/country, timestamp, and installed browser crypto wallets,” Semon said.
The collected information is then sent to the attacker through a Telegram bot. Semon noted that the Google Apps Script will only load the side panel and collect this information if the user viewing the document is logged in to Google.
ClickFix lures, download buttons aim to spread malware
When the user enters the attacker-provided key, they are met with an error as well as OS-specific instructions for downloading an “update” to resolve the issue. For both macOS and Windows, there are two options presented: a ClickFix-style lure instructing the user to run terminal commands and a button to download payloads through the browser.
On macOS, the command pasted into Terminal was found to be misconfigured, with the remote URL pointing to localhost and leading to a redirect loop. The download button leads to a GitHub Releases page hosting a malicious macOS disk image called “GAPIUpdate.dmg,” which first displays “setup” instructions guiding the user to bypass macOS Gatekeeper by entering their admin password.
When these instructions are followed, the malware — which Huntress said is “highly consistent” with the Atomic macOS Stealer (AMOS) — executes, collecting browser passwords and cookies, cryptocurrency wallet data, keychain data and Telegram files. It also triggers a Transparency, Consent and Control (TCC) prompt that requests permission to access the Notes.app database, which is also stolen if the user accepts the prompt.
The stolen data is staged at /tmp/lksopo, archived and sent to a remote server. The malware also retrieves a LaunchDaemon plist from another remote server and executes it via launchctl bootstrap, establishing a persistent backdoor that repeatedly polls a command-and-control (C2) address for commands, including arbitrary command execution and the ability to turn the host into a SOCKS5 proxy node, Huntress said.
On Windows, the ClickFix lure containing an encrypted PowerShell script also failed, as the payloads it attempts to retrieve from remote servers were no longer available at the time of Huntress’ analysis. However, investigating the C2 domains in VirusTotal showed they were used in previous campaigns and associated with IP addresses that previously delivered a PowerShell-based malware loader called Sleestak.
The download button launches an automatic Windows installer using a signed ClickOnce deployment manifest called GapiUpdate.application, Huntress said. The application displays a fake “Google Workspace Marketplace” portal while downloading additional payloads, which Huntress noted to be consistent with a campaign
discovered by Haveibeensquatted and
reported on by GBHackers this month.
According to GBHackers, the earlier campaign led to the deployment of NeedleStealer for theft of browser credentials and sessions, wallet extensions, Telegram data and screenshots, another Rust-based stealer for collection of data from additional browsers, desktop wallets, password managers, VPN and SSH materials, cloud configurations, developer tooling, messaging applications and files, and a Go-based RAT for persistent backdoor access.
Additional Dropbox DocSend lure spreads NetSupport RAT, fake certificate authority
After the Huntress researcher did not respond to the attacker for some time, they followed up with an additional social engineering lure: a fake Dropbox DocSend share link that directs the victim to install the “desktop version” of DocSend from the typosquatted domain docsend[.]online.
The malicious file served to macOS hosts contains the same AMOS infostealer payload spread by the Google Doc, while the Windows version included three different payloads. The Windows payloads appeared to have been removed from the original download endpoint at the time of Huntress’ analysis, however, the researchers were able to recover them after discovering additional subdomains serving the same malware.
The first payload was NetSupport RAT, a maliciously repurposed version of the legitimate NetSupport Manager 14.10.0004. The second payload, discussed as a Lenovo driver package, uses process hollowing to run inside MsBuild.exe and creates a self-signed certificate authority on the victim host.
“The certificate authority’s private key is written to disk beside the certificates, so a trusted certificate can be minted for any domain at will,” the Huntress researchers wrote.
The malware leveraged this capability to issue itself a certificate for the VirusTotal domain and set up a local proxy that causes all VirusTotal traffic from the victim machine to redirect, allowing VirusTotal lookups to be blocked or directed to fake results, Huntress noted.
The third payload was a Ledger implant that also posed as a Lenovo driver and used MsBuild hollowing for execution. The implant creates a Run registry entry called “Ledger Wallet Installer” that enumerates installations of the Ledger cryptocurrency wallet and checks program files for their configurations.
The implant polls a remote URL at irregular intervals, but the server only returned empty responses for all of the 18 polling instances during Huntress’ analysis. Additionally, the researchers noted that the persistence mechanism was faulty, as the Run entry points to MsBuild with no arguments or project file.
Huntress advised attendees of Hacker Summer Camp and other conferences to look out for social engineering campaigns framed as post-conference follow ups and opportunities, especially being wary of requests to run terminal commands, install files and enter device passwords.
Semon noted that social engineering leveraging Google Apps Script web apps and Google Documents is not new, often evading detection due to the use of legitimate Google-owned domains.
“A shared Google Doc from someone you don’t know can be executable content, not inert text. Treat it like any other unknown email attachment,” Semon advised. “Open unknown docs signed out or in a private window. That single habit defeats the whole collection layer we saw used here.”
Semon also noted that no legitimate document will require a user to perform a software update, execute a terminal command or perform a macOS Gatekeeper bypass.
“A doc that ‘fails to decrypt’ and then offers to fix it is 10/10 times malware,” Semon concluded.