Hacker Poses as Crypto News Journalist to Target Cybersecurity Professionals

A malicious actor impersonating an employee of a prominent cryptocurrency news website attempted to compromise several cybersecurity experts in early August, coinciding with major hacking conferences Black Hat and Def Con. The hacker reached out to attendees on the social media platform X through both public replies and direct messages, employing Google Docs to persuade them to install malware, according to recent findings by cybersecurity researchers.

On Wednesday, security firm Huntress released a detailed blog post outlining the hacking efforts, which prominently featured one of its own researchers who engaged with the hacker to uncover their tactics. Throughout their communication, the hacker communicated in broken English, querying the researcher about their plans for upcoming conferences and referencing an event supposedly organized by the cryptocurrency news outlet.

The hacker subsequently provided a legitimate-looking Google Doc, purporting to outline the planning for the fictitious conference. The document included a sidebar designed to mimic an encrypted interface, enticing targets to enter a fake decryption key supplied by the hacker. This deception was intended to be the initial step toward installing malware tailored for both macOS and Windows systems, depending on the target’s operating system.

To enhance the deception, the hacker utilized Google App Script, a tool that allows for user interface customization within Google Docs, including the addition of menus and sidebars.

Among the malware types the hacker attempted to distribute were an infostealer targeted at Apple computers, a remote desktop viewing tool disguised as Windows malware, and a counterfeit installer for the cryptocurrency wallet, Ledger.

The individual identified by Huntress as the hacker did not respond to a private message sent by TechCrunch for further comment. The campaign bears resemblance to other instances where hackers, from various backgrounds including government-backed groups, have targeted cybersecurity professionals, leveraging real platforms and services to enhance credibility.

As of now, Google has not provided a response regarding this hacking campaign when contacted by TechCrunch for inquiries on whether they were aware of similar incidents.