A real phishing campaign is targeting DEF CON speakers and attendees through X/Twitter messages pretending to be a Coindesk executive. Victims are sent to a Google document that attempts a “click-fix” trick to get them to paste malicious commands into a terminal or download malware. The goal is to steal crypto assets and sensitive credentials like authentication tokens and SSH keys.
This campaign targets DEF CON speakers and attendees through direct messages on X/Twitter. The attacker poses as a vice president of Coindesk and proposes collaborating on a future conference, a pretext designed to feel plausible to people who regularly network at industry events. The message includes a link to a Google document that appears to contain collaboration details.
Once the target opens the document, it attempts a click-fix style attack. The victim is instructed to copy and paste a command into a terminal or command shell, framed as a step needed to view or access the content. If that fails to work, the document pushes a direct malware download instead. The resulting payload behaves differently depending on whether the victim is running Windows or macOS, and it can pull down additional stages after the initial infection.
The pretext exploits a real pattern in conference culture: speakers and attendees regularly receive unsolicited outreach about collaboration opportunities, sponsorships, and future events. A message claiming to be from a recognizable media brand's executive fits naturally into that flow, lowering suspicion before the victim even opens the link.
The click-fix mechanic adds a second layer of manipulation. Instead of asking the victim to run an obviously suspicious file, it frames the terminal command as a routine troubleshooting step needed to view the document. That framing can bypass the instinct many people have to avoid downloading executables, since copying and pasting text feels lower-risk than running a program.
Treat collaboration requests received through social media DMs as high-risk until verified through a separate, trusted channel, such as a known email address or a direct call. Never paste commands from a document or webpage into a terminal; escalate anything that asks for this to IT or security staff instead of trying to resolve it yourself.
Because the malware in this campaign focuses on stealing cryptocurrency data, authentication tokens, and SSH keys, minimizing stored credentials on endpoints and using strong account controls can limit the damage if a device is compromised. Conference speakers, staff, researchers, engineers, and executives attending industry events should be aware that impersonation of recognizable media or industry figures is part of this pattern, and that verifying identity before clicking is the most effective defense.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a phishing operation on X/Twitter where attackers impersonate a vice president of Coindesk and invite DEF CON speakers and attendees to collaborate, sending them to a Google document.
It is a social engineering technique where a document or webpage instructs the victim to copy and paste commands into a terminal or command shell, which actually runs malware instead of fixing an access problem.
The malware payload targets cryptocurrency data, authentication tokens, and SSH keys, and behavior can differ depending on whether the victim is using Windows or macOS.
Conference speakers, conference staff, security researchers, engineers and developers, and executives attending industry events are the primary targets.
Imagine you’re a DEF CON speaker and get this DM on X: “Hi, I’m the VP at Coindesk. We’d like to collaborate on a future conference. Here’s a Google Doc with details.” You click, and the Google Doc doesn’t pitch content. It tells you: “To view the file, run this command in Terminal or Command Prompt and try again,” or download a file and run it. That’s the whole scam. That “click-fix” command is malware. On Windows or macOS it quietly hunts for crypto wallets, authentication tokens, and SSH keys, basically the keys to your kingdom, then can pull down even more payloads. Here’s the move: if any Google Doc or message tells you to copy and paste a command into Terminal or Command Prompt to ‘fix’ access, stop and send it to IT or Security, do not run it.
After Black Hat/DEF CON, cybercriminals allegedly targeted conference attendees by impersonating a CoinDesk executive over X direct messages. Victims were pushed into a realistic workflow using Google Docs and a fake Dropbox DocSend installer to trick them into running malware on macOS or Windows.
A researcher was targeted after Black Hat/Def Con by an attacker posing as a CoinDesk executive and using X direct messages to build trust. The scam used familiar platforms (Google Docs and Dropbox DocSend) to push “ClickFix”-style steps or a fake installer intended to get the victim to run malware.
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers linked DigiCert’s April 2026 breach to a GoldenEyeDog sub-group that tricked support staff into running a malicious file delivered through a customer support chat. The attackers then abused DigiCert’s support portal features to intercept EV code-signing certificate “initialization…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
