Someone targeted security researchers using a fake crypto conference as a lure

During Black Hat and DEF CON, a hacker posing as a staffer from a major crypto news outlet messaged cybersecurity professionals on X, sharing a Google Doc that mimicked a conference plan with a fake encrypted sidebar. The doc asked for a decryption key, then used Google Apps Script to deliver macOS infostealers, a Windows remote-desktop tool, and a counterfeit Ledger wallet installer. A Huntress researcher feigned cooperation to document the attacker’s techniques.