Hacker posed as crypto news outlet to target cybersecurity experts
What's the story
Cybersecurity professionals are often the hardest to hack, given their expertise in identifying and mitigating threats. However, a recent attack has shown that even these experts can be targeted. A hacker pretending to work for a leading cryptocurrency news outlet targeted several cybersecurity professionals around the time of the Black Hat and Def Con hacking conferences earlier this month. The attack was detailed by security firm Huntress in a recent blog post.
Deceptive strategy
The hacker's method of operation
The hacker approached attendees on social media platform X, using both public replies and direct messages.
They then used Google Docs in an attempt to lure the targets into downloading malware.
The attack was particularly convincing due to the use of a legitimate Google Doc and a feature from the tech giant.
Bait and switch
Engaging the target in conversation
In the blog post, Huntress revealed that the hacker had a conversation with one of its researchers.
The attacker, using broken English, asked whether they were planning to attend an upcoming conference, then mentioned one supposedly organized by the crypto news site.
This was all part of their strategy to lure cybersecurity professionals into their trap.
Malware deployment
Phishing document with fake encryption prompt
The hacker then shared a legitimate-looking Google Doc, which appeared to be a planning document for the fake conference.
It had a sidebar made to look like it was encrypted, tricking the target into entering a fake decryption key provided by the hacker.
This was the first step in a process that would lead to malware installation on macOS and Windows systems, depending on what OS the target used.
Targeted malware
The hacker attempted to push various malware strains
The hacker tried to trick the Huntress researcher into installing an infostealer for Apple computers, a remote desktop viewing tool repurposed as malware for Windows, and a fake installer for the cryptocurrency wallet Ledger.
However, they did not respond when TechCrunch reached out with a private message on X.
This highlights the ongoing threat of cyberattacks targeting even the most skilled cybersecurity professionals.