Threat Actor Targets DEF CON Attendees With 2 Lures Delivering AMOS and NetSupport RAT
Updated
Updated · scworld.com · Aug 20
Threat Actor Targets DEF CON Attendees With 2 Lures Delivering AMOS and NetSupport RAT
3 articles · Updated · scworld.com · Aug 20
Summary
August 9 messages sent to DEF CON and Black Hat attendees used X DMs posing as a CoinDesk executive, steering targets to a Google Doc with a malicious Apps Script sidebar and a fake “decryption” flow.
That Google Doc pushed victims to run terminal or PowerShell commands or download a fake update, delivering AMOS on macOS and Windows loaders that fetched additional payloads while reporting activity through Telegram.
A second lure the next day impersonated Dropbox DocSend and served counterfeit installers: macOS users again got AMOS, while Windows users received a staged chain that profiled the host and pulled three password-protected payloads.
Those Windows payloads included NetSupport Manager 14.10.0004 configured as a stealth RAT, a local HTTPS-intercepting proxy that installed a rogue root certificate, and a Ledger wallet implant polling for commands.
Researchers said the campaign shows persistent post-conference social engineering built on trusted platforms—X, Google Docs, Dropbox and GitHub—and warned any system that interacted with the lures should be isolated, reimaged and have credentials rotated.