Someone targeted security researchers using a fake crypto conference as a lure
- ID
- 16214
- Status
- summarized
- Published
- 21 Aug 2026, 4:00 AM
- Fetched
- 21 Aug 2026, 5:01 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/08/20/someone-targeted-security-researchers-using-a-fake-crypto-conference-as-a-lure/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 5.5
- Created
- 21 Aug 2026, 5:02 AM
- Tags
- Audience
- developersai_agent_users
What happened
A threat actor impersonated a crypto news outlet on X, messaging security researchers around Black Hat and Def Con 2026 about a fake conference. They sent a legitimate Google Doc with a fake 'encrypted' sidebar built using Google Apps Script, tricking targets into entering a provided decryption key that initiated malware installation — an infostealer on macOS and a repurposed remote desktop tool on Windows. Huntress published the full writeup after one of its researchers played along to observe the attack chain.
Why it matters
The attack technique — using Google Apps Script to render fake UI elements like an 'encrypted' sidebar inside a real Google Doc — is reproducible and could be aimed at non-security targets too. If you or your team share Google Docs externally or build Apps Script add-ons, recognize that the Docs UI can be customized to display misleading security indicators, and treat any 'enter this decryption key' prompt in a shared doc as suspicious.
Discussion angle
How Google Apps Script's ability to customize Docs sidebars and menus can be abused to fabricate trust signals — and whether your own automation or agent workflows that share Google Docs could be spoofed the same way.