On August 9 an X account called @HartmansDoeke sent a Huntress researcher a direct message, introducing itself as CoinDesk's VP and Head of Marketing and asking for help with an upcoming online conference. The profile used one person's photograph with a different person's name. The researcher spotted it straight away and kept the conversation going anyway.
That decision is why we know what the campaign actually delivers. It ends with a certificate authority installed on the victim's computer.
A decryption key built to fail
The lure was a Google Doc dressed up as a planning document. Opened by a signed-in Google user, it rendered a custom Google Apps Script sidebar, a file named DecryptPanel.html, which checked a short list of hard-coded keys, profiled the host, reported through Telegram and offered separate macOS and Windows paths. The access key supplied in the DM never works, and that is the design: the failure pushes the target into the sidebar's offer to fix things, either ClickFix style instructions to paste a command into a terminal or a manual download.
On macOS that download served GAPIUpdate.dmg from a GitHub Releases page the actor controlled, with instructions walking the user through bypassing Apple's Gatekeeper and typing their password. Static analysis put it as Atomic macOS Stealer: browser passwords and cookies, cryptocurrency wallets, keychain data, Telegram files, and a single consent prompt asking for the entire Notes database. It ships the haul to hxxp://86[.]54[.]25[.]213/log, then installs a LaunchDaemon that polls for commands including arbitrary shell execution and turning the host into a SOCKS5 proxy. It never touches Desktop or Documents, the same tuning for quiet seen in the Mac stealer hidden in a fake Claude Code guide.
When the target stalled, a second document
The next day the actor followed up with a fake Dropbox DocSend share. The counterfeit installer is an Electron app inside an NSIS package, signed with a code-signing certificate stolen from Discord Inc. that does not validate, fronted by an onboarding carousel built from genuine Dropbox marketing copy. Every error path in the loader behind it is silently discarded, so a dead server and a successful compromise look identical on screen. Huntress recovered a working stage two from a live sibling campaign running the same code under a SignNow brand.
A certificate authority on your machine
Stage three takes a desktop screenshot, then pulls three password-protected archives. The first is NetSupport Manager 14.10.0004, configured for stealth and calling home to msedgewebview1[.]pro and msedgewebview2[.]pro over cleartext HTTP on port 443, so the traffic passes as Microsoft Edge WebView.
The second is the one worth pausing on. Disguised as a Lenovo driver package with a stolen Lenovo certificate, it hollows out Windows' own MsBuild.exe and builds a public key infrastructure on the victim: a self-signed authority presenting as O=Google Trust Services, CN=WR3, pushed into the system root store, a certificate issued for www.virustotal.com, that hostname pointed at 127.0.0.1 in the hosts file, and a firewall rule named LocalProxy. VirusTotal traffic is then answered locally, over HTTPS, by a certificate that validates without a single warning, and lookups can be blocked outright or returned with fabricated results. The private key is written to disk, so any domain can be forged next, and a fresh authority is generated on every host, so blocking one thumbprint accomplishes nothing. The third archive is a Ledger wallet implant that persists under a registry entry named Ledger Wallet Installer.
Huntress names no actor. Its analysts note Russian-language comments in the script and Cyrillic characters in the C2 traffic, an observation rather than an attribution.
Treat post-conference DMs as hostile
The rule is old and keeps working: a document that asks you to run a command is the attack. The same account replied with boilerplate to a large number of conference attendees, so this was volume outreach rather than one targeted researcher. On Windows hosts, an unexplained Google Trust Services root certificate, a hosts file entry for www.virustotal.com or a firewall rule called LocalProxy are worth hunting for now. Indicators from the original report by Stuart Ashenbrenner, Lindsey Welch, Jamie Levy and Andrew Brandt include hxxps://apple-googleapi[.]com/i, hxxps://1foqo[.]lat/core4, 86[.]54[.]25[.]213, 192[.]253[.]248[.]181 and 87[.]120[.]104[.]88. The delivery half of this is a commodity, as one loader tying ClickFix scams to fake game downloads showed last week.
The last step is not. Most malware hides from the analyst. This one waits for the analyst to check, and answers.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.