For malicious hackers, cybersecurity experts are among the most challenging targets to exploit, as they are often well-equipped to detect and thwart such attempts.
Recently, a hacker impersonating an employee of a prominent cryptocurrency news outlet focused on several cybersecurity professionals in the lead-up to the Black Hat and Def Con conferences. The hacker interacted with potential victims through the social media platform X, using both public comments and direct messages while attempting to install malware via Google Docs, according to researchers.
A security firm, Huntress, disclosed this hacking strategy in a blog post published on Wednesday. The company had the opportunity to observe the attack through one of its researchers who pretended to engage with the hacker to uncover their intentions.
Using broken English, the hacker inquired if the researcher planned to attend an upcoming conference, mentioning one supposedly organized by the crypto news site they were pretending to work for, as shown in a screenshot of their conversation.
Following this, the hacker shared a legitimate-looking Google Doc that seemed to serve as a planning document for the fictitious conference. The document was crafted to appear encrypted, with a sidebar aimed at deceiving the target into entering a fake decryption key provided by the hacker. This was the initial step towards installing malware compatible with either macOS or Windows, based on the recipient’s operating system, as explained by Huntress.
To enhance the authenticity of the sidebar, the hacker utilized Google App Script, which allows developers to modify the Google Docs interface with custom menus and sidebars.
The hacker attempted to deceive the Huntress researcher into installing various types of malware, including an infostealer for Mac systems, a modified remote desktop tool for Windows, and a counterfeit installer for the Ledger cryptocurrency wallet.
The hacker did not respond when approached by Huntress researchers through a private message on X.
Cybersecurity experts have been targeted in the past by various hackers, including state-sponsored attackers utilizing sophisticated spyware and even those using fake social media profiles. This particular scheme gained credibility due to the use of a legitimate Google Doc and its features.
Google has not commented regarding whether they are aware of this or similar hacking activities when contacted for information.
