Security professionals may be surprised by the Google Docs trick behind this attack – Automated Home

A real Google Doc became the front door for a malware campaign targeting cybersecurity professionals after Black Hat and DEF CON 2026 in Las Vegas.

Attackers used a fake crypto conference invitation, a convincing Google Workspace document, and a malicious Apps Script sidebar to make a trusted service part of the infection chain.

The campaign eventually delivered an infostealer, remote access software, and a cryptocurrency wallet implant to macOS and Windows devices, according to Huntress research published August 19, 2026.

How the Google Docs trap worked

The operation began on August 9, when an X account posing as CoinDesk’s vice president and head of marketing contacted security professionals about a supposed online crypto conference.

The messages used broken English and generic promotional language, but the timing made the approach believable. Conference attendees had just spent days exchanging contacts, documents, and plans with unfamiliar people.

Targets received a Google Doc presented as an event planning document. Opening it did not immediately download an executable, which helped the lure feel safer than a conventional attachment.

How the fake document gained trust

Instead, the document displayed a custom sidebar built with Google Apps Script. The panel claimed the document was partially encrypted and asked victims to enter an access key supplied through direct messages.

Google Apps Script is a legitimate platform for adding menus, dialogs, and sidebars to Google Docs, Sheets, and Slides. Its presence therefore did not automatically signal that a document was malicious.

Why the sidebar was so effective

The campaign’s DecryptPanel.html file displayed a fake encrypted view, checked a small set of hard-coded keys, collected host and victim information, and reported activity to the attacker through Telegram.

The supplied key was intentionally designed to fail. That failure triggered the next stage, offering either a ClickFix-style manual update process or a direct download, with separate paths for macOS and Windows.

Why the failed decryption was deliberate

The approach is notable because the victim remains inside a familiar Google interface during the most important part of the social engineering.

A trusted URL can lower suspicion even when the content inside it is hostile, particularly when the document appears connected to a believable professional event.

How macOS users were targeted

Mac users were shown a terminal-based route and a manual download option. The first instructed victims to paste a curl command into Terminal, a tactic increasingly associated with ClickFix campaigns.

Huntress found that the command endpoint redirected into a loop during testing, so it did not deliver a payload at that time.

The technique itself remains dangerous because it asks users to execute attacker-supplied code, bypassing the protections users normally receive from simply viewing a document.

What the macOS payload could steal

The second route offered a file called GAPIUpdate.dmg from a GitHub Releases page. Victims were guided through bypassing Gatekeeper and entering their password.

Static analysis connected the macOS payload to Atomic macOS Stealer, commonly known as AMOS. The infostealer can target browser passwords, cookies, cryptocurrency wallets, Keychain data, Telegram files, and Notes data.

Huntress observed stolen information being staged in a temporary directory before exfiltration. The malware also fetched a LaunchDaemon configuration, establishing persistence that could support command execution, proxying, and later removal.

How Windows users were targeted

Windows users faced a fake Google API Connector update delivered through ClickOnce. The deployment manifest pointed to a malicious domain and used a certificate tied to a Norwegian entity that appeared stolen or fraudulently issued.

After installation, the program displayed a fake Google Workspace Marketplace while silently downloading additional components. Another ClickFix-style route used an encoded PowerShell command to retrieve a loader.

The loader staged three encrypted payloads under a Windows update-themed directory. One was NetSupport Manager, a legitimate remote administration product repurposed for malicious access.

How Windows persistence became deeper

NetSupport was configured to hide visible indicators from the victim. Another component disguised itself as a Lenovo driver and used a stolen certificate while hollowing MsBuild.exe to execute its payload.

It also installed a self-signed certificate authority and redirected VirusTotal traffic through a local proxy. The certificate presented itself as Google Trust Services, allowing forged certificates to appear trusted locally.

The third payload targeted Ledger software and cryptocurrency activity. It created a startup entry, looked for Ledger installations, generated a bot identifier, and contacted an external command endpoint.

A fake DocSend follow-up added pressure

When the first document failed to compromise the target, the attacker followed up with another file pretending to be a Dropbox DocSend share. It urged the recipient to install a desktop version of DocSend.

The fake download site delivered AMOS to macOS users. On Windows, an Electron and NSIS installer used a stolen Discord certificate and showed a realistic Dropbox-style onboarding sequence.

The Windows loader collected hardware and system details, submitted the profile to an external server, and executed a JavaScript stage in memory. It also captured a full desktop screenshot before deploying additional payloads.

TL;DR

• Attackers used a legitimate Google Apps Script sidebar to turn an ordinary Google Doc into the opening stage of a malware campaign.
• The campaign targeted security professionals after Black Hat and DEF CON, using a fake crypto conference invitation to establish credibility.
• macOS victims faced AMOS through fake updates, while Windows victims received NetSupport, certificate manipulation, and a Ledger-focused implant.
• A second fake DocSend lure showed how attackers could continue the campaign when the initial Google Docs trick failed.
• Google Workspace users should treat unexpected commands, installers, password requests, and security bypass instructions as serious warning signs.

This article was made with AI assistance and human editing.

If you liked this, you might also like: