An invitation to a nonexistent crypto conference and a malware-infected Google Docs link targeted cybersecurity experts. One diligent researcher detected the scam and sounded the alarm.
A phishing campaign targeting attendees at two major cybersecurity conventions in Las Vegas earlier this month used an invitation to a bogus cryptocurrency event and an innocent-looking Google Docs link in a ploy to trick victims into downloading malware.
The scheme was uncovered by the cybersecurity platform Huntress after one of its researchers was contacted online by someone posing as the vice president and head of marketing at the legitimate digital media company CoinDesk, which covers the crypto and blockchain industry.
Using a fake account on X, the threat
Using a fake account on X, the threat actor sent boilerplate direct messages to people who attended the recent Black Hat and Def Con hacker conventions in Vegas.
“hi there are you have plans attend next conferences?” the attacker wrote in DMs posted by Huntress. “I’m interested invite and happy to connect. can’t find your email.”
Refreshed leadership advice from CEO Stephanie Mehta
An Inc.com Featured Presentation
The attacker asked its targerts if they would be interested in signing up for an upcoming crypto-related online conference that, in fact, did not exist.
The researcher recognized the lure as a scam
“The researcher recognized the lure as a scam and did not fall for it,” Huntress said in its August 19 report. The alert employee “continued engaging with the actor to better understand the tactics they were using.”
The campaign included sharing a Google Docs page with “more info” about the nonexistent conference. The document prompted Windows and macOS users to enter an encryption key supplied by the actor, which appeared to fail. A sidebar offered two alternatives, “both intended to download and execute malicious code,” Huntress said.
Source: www.inc.com
