Malware & Tooling · Credential Theft

Huntress traces a Google Doc malware split

Huntress documented a targeted X direct-message campaign that used a real Google Doc to steer Mac and Windows users onto different malware paths. The lure came from an account posing as a crypto marketing executive and reached multiple researchers around the end of DEF CON.

1 source · Sep 15

Timeline

• Sep 15 Reported by Huntress Blog

Sources

• Sep 15 Huntress Blog

  Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware | Huntress

  A single X DM split into two malware chains: AMOS stealer on Mac, NetSupport Manager on Windows, see the Huntress SOC analyst breakdown.

  original

Part of the PlainSec briefing for 2026-09-14

Every edition of this story: Huntress traces a Google Doc malware split