A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an infostealer on macOS or a PowerShell-based loader chain on Windows.
This incident began with an unexpected outreach on X (Twitter), where a threat actor posed as a crypto marketing executive and struck up a conversation with a security researcher. The conversation led to a link for a real Google Doc, not a fake or spoofed one. Inside the document, however, was a custom sidebar built with Google Apps Script that displayed a fake decryption failure message.
The sidebar then walked the target through supposed remediation steps tailored to their operating system. On macOS, victims were guided toward commands that could be copied and pasted into Terminal, ultimately installing an AMOS infostealer. On Windows, the flow led instead to a PowerShell-based loader chain. In both cases, the malware only ran because the target manually executed the provided instructions.
The core trick here was exploiting trust in a familiar tool. Because the document itself was a genuine Google Doc, many of the usual red flags associated with malicious attachments or spoofed domains were absent. The lure also leaned on urgency: a scary-looking "decryption failure" message pushed the target to act quickly rather than pause and question the request.
This approach, sometimes called a "fix it yourself" workflow, shifts the burden of executing the attack onto the victim. Rather than delivering a payload directly, the attacker convinces the target to run the commands themselves, which can bypass some technical defenses that watch for automatic downloads or executions.
Security awareness training should reinforce that a link or file coming from a trusted platform, such as Google Docs, does not guarantee the content inside is safe. Employees across roles, including executives, marketing staff, and technical researchers, should be encouraged to treat "copy this command to fix it" prompts as a serious warning sign. The safest response is to stop and verify the request with IT or security teams through a known, separate channel rather than following in-document instructions. Building this habit of pausing before manual command execution is one of the most effective defenses against this type of technique, regardless of how legitimate the surrounding document or platform appears.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A threat actor sent a real Google Doc containing a custom sidebar that displayed a fake decryption failure message, then urged the recipient to manually run commands to fix it, which installed malware.
The payload differed by operating system: an AMOS infostealer was used on macOS, while a PowerShell-based loader chain was used on Windows.
The attacker approached the target through an X (Twitter) conversation, posing as a crypto marketing executive before sending the malicious Google Doc link.
The document itself was a real, trusted Google file, but its custom sidebar was weaponized to display a fake error and manual fix instructions, exploiting user trust in a familiar tool.
Imagine a new crypto “marketing exec” DM’ing you on X with a Google Doc link that looks totally legit. You open the real Google Doc, but a custom sidebar pops up saying “decryption failure” and tells you to click a Manual Update button or run special commands for Mac or Windows. That’s the trap. Those copy‑paste commands can drop an AMOS infostealer on macOS or kick off a PowerShell loader chain on Windows, just because you trusted a familiar Google Doc. If any doc tells you to copy commands into Terminal or PowerShell to “fix” it, stop. Don’t run them, send it to IT or security and ask if it’s safe.
The recap describes a real Microsoft 365 phishing campaign using DocuSign-themed emails that push victims through multiple redirects to a fake sign-in page. The goal is to steal session tokens (so attackers can log in even if a password changes) and also perform “device code” style sign-in abuse.…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
Attackers are buying sponsored Google search ads that send Mac developers to fake OpenAI Codex download pages. The pages instruct victims to paste a Terminal command that looks like a normal install step, but actually downloads and runs a multi-stage malware payload.
Attackers are sending fake ChatGPT billing emails that pressure people to “update payment” within 48 hours to avoid service interruption. The message links to a convincing look‑alike ChatGPT login page via a Google redirect, aiming to steal OpenAI credentials.
A campaign dubbed “TerminalFix” uses compromised websites to display fake Cloudflare CAPTCHA checks that instruct visitors to copy and run a PowerShell command. The goal is to get a user to run attacker-provided commands themselves, which can lead to persistent access and deeper intrusion into the…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
