Fake Crypto Conference Invite Used to Target Security Researchers
A threat actor impersonating staff from a prominent cryptocurrency news website has been reaching out to cybersecurity researchers with invitations to a fake industry conference. Instead of a normal PDF or website, the lure relied on Google Docs links, likely chosen because they feel trustworthy and can slip past email security filters.
Once a target opened the shared document, the attacker attempted to deliver malware, apparently hoping to compromise the researcher's system or steal credentials. The campaign appears narrowly targeted at people who work in security, rather than the general public, suggesting the attacker wanted access to sensitive research, contacts, or client data.
This is a variation on a familiar playbook: using a topic (crypto, conferences, recruiting) that a specific professional audience finds credible, then hiding malicious payloads inside seemingly benign cloud documents rather than traditional attachments.