Beyond DEF CON: The Rise of Post-Conference Phishing Campaigns

Threat Type: Targeted Phishing | Social Engineering | ClickFix | Infostealer
Target: Cybersecurity professionals and conference attendees
Severity: High

Executive Summary

Cybersecurity professionals who attended Black Hat and DEF CON have been targeted in a highly tailored phishing campaign designed to deliver malware through fake conference invitations.

The attackers first approached targets on X, posing as representatives of legitimate organisations and discussing a supposed upcoming cybersecurity or cryptocurrency event. Once a conversation was established, victims were sent a Google Doc containing event information.

The document looked convincing enough to get past the first layer of suspicion. Its real purpose, however, was to turn a trusted collaboration platform into the delivery mechanism for malware.

How the Attack Unfolds

The attack follows a carefully constructed chain:

X contact → Fake conference invitation → Google Doc → Fake encryption prompt → ClickFix → Malware

The Google Doc contained a custom sidebar built using Google Apps Script, Google's scripting environment for adding functionality to Workspace applications. The sidebar claimed that the document's contents were encrypted and asked the victim to enter a decryption key supplied by the attacker, This key was deliberately made to fail.

The "solution" then instructed the victim to open Terminal and copy and execute a command.

This is the ClickFix technique: instead of exploiting the computer directly, the attacker convinces the victim to execute the malicious command themselves.

What Happens Next?

The payload depended on the victim's operating system.

On macOS, the campaign delivered AMOS (Atomic macOS Stealer), an information-stealing malware capable of harvesting browser credentials, cookies, passwords, Keychain data and cryptocurrency wallet information.

On Windows, researchers observed a combination of malware including a Remote Access Trojan (RAT), a fake cryptocurrency wallet application and a proxy component designed to intercept network traffic.

A RAT is malware that gives an attacker remote access to a compromised computer, potentially allowing them to monitor activity, steal information or execute commands.

The Backup Plan

When the initial Google Doc did not work, the attacker did not simply disappear.

They followed up with another document disguised as a Dropbox DocSend file. The supposed document-sharing application required the victim to install a desktop application, but the download instead delivered additional malware.

This second attempt is particularly notable because it shows the campaign was not a one-shot phishing exercise. The attacker was prepared to change the lure when the first approach failed.

Why Cybersecurity Experts?

DEF CON and Black Hat create an unusually useful environment for social engineering.

Attendees exchange contact information, discuss research, share documents and receive invitations to events and side meetings. An attacker can use these legitimate interactions as context for malicious outreach.

In this case, the attackers appeared to identify people associated with the conferences and approach them shortly afterwards. That timing made an unsolicited message feel like a normal post-conference follow-up.

The real lesson is this: expertise does not make people immune to social engineering. In many cases, familiarity with the context makes deception even harder to spot.

Key Intelligence

• Initial access: Social media engagement and direct messages on X.

• Lure: Fake cybersecurity/cryptocurrency conference invitation.

• Delivery mechanism: Google Docs and later a fake Dropbox DocSend document.

• Technique: ClickFix-style command execution.

• macOS payload: AMOS infostealer.

• Windows payloads: RAT, cryptocurrency wallet implant and proxy component.

• Primary objective: Credential, browser, cryptocurrency and other sensitive data theft.

• Notable tactic: Follow-up lures were used when the initial attack failed.

Defensive Recommendations

Organisations should treat unexpected conference invitations and shared documents as potential phishing vectors, particularly when they originate from newly created or unverifiable social media accounts.

Security teams should also:

• Monitor for suspicious command execution immediately after users access Google Docs or file-sharing links.

• Detect unusual use of Terminal, PowerShell and Command Prompt following browser activity.

• Restrict execution of unapproved software delivered through document-sharing platforms.

• Review browser, credential-store and cryptocurrency-wallet access following suspected AMOS infections.

• Revoke active sessions, reset credentials and rotate API keys or other secrets if a user executes a suspicious command.

• Isolate and investigate systems where the lure was opened and commands were executed.

Key Takeaway

This campaign is a strong example of context-aware social engineering.

The attackers did not simply send a random malicious document. They built a believable story around a real event, established contact through a professional social platform, used familiar collaboration tools, and adjusted their approach when the first lure failed.

For organisations, that makes post-event communications, professional networking platforms and trusted collaboration services worth including in phishing monitoring—not just email.

‍