Someone targeted security researchers using a fake crypto conference as a lure

Recent reports from outlets including TechRadar, TechCrunch, Infosecurity Magazine, and SC Media reveal an ongoing security threat directed at professionals within the cybersecurity industry. Specifically, attendees of major industry gatherings such as Black Hat and DEF CON have been targeted by malicious actors utilizing sophisticated social engineering tactics. According to the coverage, the scheme involves a fabricated cryptocurrency conference and the impersonation of a CoinDesk executive to deceive victims. Coverage does not yet specify the total number of individuals compromised or the exact identities of the perpetrators behind the operation. Additional technical breakdowns provided by Huntress and itsecurityguru.org detail the exact mechanisms employed in the attacks.

The campaign relies heavily on a booby-trapped Google Doc containing malicious Apps Script designed to deliver malware and prompt users into handing over sensitive details. This lure was deployed directly against researchers following the conclusion of the DEF CON conference. While sources such as Zamin.uz and Bitcoin World confirm the broad outlines of the fake crypto conference scam, specific details regarding the broader infrastructure of the threat group remain under investigation by reporting organizations. This malicious activity fits into a broader pattern of persistent post-conference phishing campaigns that exploit the professional interests and networking habits of security researchers. By leveraging familiar industry touchpoints like high-profile crypto media brands and major hacker conventions, the attackers aim to bypass the natural skepticism of technical experts.

Coverage emphasizes that targeting cybersecurity professionals immediately after major conventions represents a calculated approach by the threat actors, capitalizing on the high volume of post-event communications and follow-up networking requests. As the investigation into the post-DEF CON phishing campaign continues, observers and participants are tracking further updates from technical analysts and security news outlets. Coverage does not yet specify whether law enforcement agencies have intervened or if additional conference dates outside of the Black Hat and DEF CON cycle have been targeted by the same malicious network. Future updates from reporting organizations are expected to provide more insight into the specific strains of malware delivered through the Google Doc Apps Script mechanism and any broader implications for the affected technical community.