A Huntress researcher came home from DEF CON to the usual pile of direct messages on X. One was from an account presenting itself as CoinDesk's head of marketing, using one real person's name over a different person's photograph, pitching an upcoming crypto conference. The researcher spotted the setup immediately and ran nothing, but kept the conversation going. It ended with a certificate authority built by the attacker sitting inside the company's test environment.
Huntress SOC analysts Ryan Dowd and Jon Semon took the chain apart and published their findings this week. The same account had messaged multiple security researchers with identical boilerplate. Dowd calls it a volume play rather than targeted work, and points to social media complaints about the account going back to October 2025.
Opening the document is the first payload
The lure was a link to a genuine Google Doc, handed over with an access key to unlock the conference details. The document carried a sidebar showing a fake decryption failure and offering remediation steps, including commands to paste into a terminal. That sidebar was a Google Apps Script bound to the document, running client-side in the reader's browser, which is why it never raised an OAuth consent prompt.
It did not need a click to earn its keep. Simply opening the document while signed in reported the viewer's IP address, location and browser back to the operator over the Telegram API, along with a check for MetaMask and Ethereum, Phantom, Tron and Solana wallet extensions. Everything after that was the operator grading the target. Windows and macOS visitors were routed down different paths, and mobile visitors were sent nothing at all, because there was no point serving a payload to a phone. Huntress found Russian comments in the source code and in packet captures of the command and control traffic, which it says supports but does not prove a Russian-speaking operator. The analysts declined to name a group at all.
Mac gets a stealer, Windows gets stolen certificates
Mac users who pasted the commands launched a piped zsh chain. Those who chose the manual route were handed a disk image from the attacker's own GitHub repository, complete with Gatekeeper bypass instructions and a password prompt. The payload was a variant of the AMOS stealer, reaching for browser data, cryptocurrency wallet data, Telegram data, Apple Notes, cookies and the macOS login keychain. Huntress notes its resemblance to the six-stage MacSync chain the same team documented last month.
Windows users were told to update a "Google API Connector", an application signed with a certificate belonging to a small Norwegian company and shipped using Microsoft's own ClickOnce deployment feature. A second document, sent later through DocSend, carried an installer signed with a certificate stolen from Discord Inc. whose signature did not validate. A third payload wore a genuine stolen Lenovo certificate. The final stage delivered NetSupport Manager 14.10.0004, configured to report to hostile infrastructure with its connect and chat alerts switched off, a TLS-intercepting local proxy, and a half-finished Ledger wallet implant.
The artifact that survives the cleanup
The proxy payload is the one worth understanding. It hollowed out MsBuild.exe, then installed a self-signed certificate authority into the system root store presenting itself as Google Trust Services, together with a leaf certificate for the VirusTotal website covering both the real domain and localhost. Add a hosts file entry and a local firewall rule, and a lookup of that site is answered locally over HTTPS with no certificate warning at all, which lets the operator block the answer or fabricate a clean one.
The process dies at reboot. The certificate authority, the hosts entry and the firewall rule do not. Because the authority is regenerated on every host, blocking a single certificate thumbprint achieves nothing, and Semon's point is that the same trick works against any domain the operator picks, including wallet sites and antivirus update endpoints. Rogue remote-management software is a familiar problem, as when fake installer sites shipped a remote tool that dropped AsyncRAT. A fraudulent root certificate is harder to notice and harder to remove.
Open a stranger's document signed out
Huntress's own advice is short. Open unknown documents while signed out, which strips away the Apps Script collection layer at no cost, and treat a host that reached the final stage as needing a rebuild rather than a process kill. Observed infrastructure includes web12api[.]com and eu03hub[.]com/get_file, and an address serving the NetSupport payload was also found hosting GTA6Mainserver[.]com and GTA6Mainweb[.]com. The full Huntress write-up carries the rest of the chain.
One detail says most about the operator. After the malware failed, the last message asked the researcher whether they needed funding, and offered to introduce a contact willing to invest a million dollars.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.