Hacker Impersonates CoinDesk Executive to Target Cybersecurity Researchers

A hacker impersonating a senior executive from CoinDesk has launched a social engineering campaign aimed at cybersecurity researchers. The campaign, which began around August 9, 2026, involved the creation of a fake online conference about cryptocurrency, enticing security professionals to participate. The attacker, using the handle @HartmansDoeke, reached out to multiple researchers shortly after major cybersecurity events, Black Hat and DEF CON, had concluded in Las Vegas.

The operation utilized a Google Doc embedded with a custom Google Apps Script designed to collect information from victims' machines. Once a target expressed interest in the conference, they were directed to this document, which quietly gathered host information and reported it back to the attacker via Telegram. For macOS users, the payload included the Atomic macOS Stealer, while Windows users were targeted with the NetSupport RAT and a counterfeit Ledger wallet installer.

The campaign was documented by researchers at Huntress, who engaged with the attacker to analyze the operation without executing any harmful payloads. Huntress and TechCrunch reported the campaign on August 20, 2026, identifying the infrastructure used by the attacker. This incident highlights the ongoing threat to the cybersecurity community, as similar tactics have been employed by other threat actors in the past, including North Korea's Lazarus Group.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News