CoinDesk Executive Impersonated in Sophisticated Cyber Attack on Crypto Researchers
A sophisticated cyber attack targeted cybersecurity researchers in August 2026, posing as a senior CoinDesk executive to lure them into participating in a fake online conference about cryptocurrency.
The threat actor, using the handle @HartmansDoeke, sent messages on X (formerly Twitter) to multiple researchers around August 9, 2026, inviting them to join a panel discussion on crypto topics. The initial contact was made via public replies and direct messages, and once a target showed interest, they were directed to a Google Doc that appeared to be a conference brief.
The document contained a custom Google Apps Script designed to fingerprint victims' machines and deliver platform-specific malware. For macOS users, the payload was a variant of the Atomic macOS Stealer, commonly known as AMOS, which collected passwords, browser cookies, crypto wallet credentials, and keychain data from Apple machines.
A follow-up lure featuring a counterfeit installer hosted on server infrastructure controlled by the attacker was also identified. The campaign didn't stop there; researchers at Huntress deliberately engaged with the attacker to study the operation without executing any harmful payloads.