A person posing as a representative of a leading crypto news outlet targeted several cybersecurity professionals around the time of the Black Hat and Def Con conferences in early August 2026, using a fake industry conference as bait. The attacker approached targets on X through public replies and direct messages before sending a booby-trapped Google Doc designed to trick them into installing malware. This matters because it shows attackers refining social-engineering tactics even against security-savvy audiences, exploiting trust in legitimate platforms like Google Docs rather than obviously suspicious tools.

Security firm Huntress detailed the campaign in a blog post published on Wednesday, after one of its own researchers played along to study the hacker's methods. The Google Doc used Google App Script to display a fake "encrypted" sidebar prompting victims to enter a bogus decryption key, which would then lead to malware tailored to the victim's operating system: an infostealer for macOS, a repurposed remote-desktop tool for Windows, and a fake installer for the Ledger cryptocurrency wallet. The hacker did not respond to TechCrunch's inquiry, and Google had not commented at the time of publication on whether it was aware of the campaign.