Google Docs Sidebar Delivers Different Malware to Mac and Windows Users
Summary
Huntress analyzed a campaign using X DMs and a malicious Google Docs sidebar to profile targets and deliver AMOS to macOS users and multi-stage malware to Windows users, including a rogue root CA that could persist after cleanup.
Key points
- The actor impersonated a CoinDesk marketing executive on X and used a Google Doc with a bound Apps Script as the lure and delivery funnel.
- Opening the document while signed in could expose a viewer’s IP, location, browser, and crypto-wallet extension information without a download or OAuth prompt; data was sent through Telegram.
- macOS users were directed to ClickFix Terminal commands or a DMG that delivered an AMOS stealer targeting browser, wallet, Telegram, Notes, cookie, and keychain data.
- Windows delivery used ClickOnce or an encoded PowerShell loader to install payloads including abused NetSupport Manager and a Ledger-focused implant.
- A payload installed a per-host self-signed root CA, hosts-file entry, and firewall rule to enable local HTTPS interception or fabricated responses; these artifacts could remain after the process stopped.
- Huntress advises opening unknown documents while signed out and notes that removing the rogue CA may require reimaging; killing the malware process alone does not remove the persistent artifacts.
Article Details
- Attack Vectors
- X direct messages impersonating a CoinDesk marketing executive used a conference-themed lure to direct recipients to malicious Google Docs.
- A Google Apps Script bound to a shared document ran in the viewer's browser, collected IP, geolocation, browser, and crypto-wallet-extension information, and sent beacons through the Telegram API.
- The document's ClickFix instructions induced macOS users to run a piped zsh command and Windows users to run an encoded PowerShell command that fetched a loader.
- Manual download paths delivered an AMOS stealer to macOS users and Windows payloads disguised as Google API Connector or DocSend software.
- The Windows chain downloaded password-protected archives, launched executables hidden and detached, and requested elevation.
- Payloads used stolen or fraudulently issued code-signing certificates, a self-generated root CA, a hosts-file entry, and a firewall rule to intercept or manipulate HTTPS traffic.
- A Windows payload used MsBuild.exe hollowing and created persistence through a Run key; NetSupport Manager was configured to redirect data to hostile infrastructure.
- Defensive Notes
- Open unknown documents while signed out to prevent the document-bound Apps Script collection layer from running.
- A rogue root CA may survive process termination; the article says reimaging removes it, while simply killing the process does not.
- Remediate carefully for persistent artifacts, including rogue certificates, hosts-file entries, firewall rules, and persistence mechanisms.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gta6mainserver[.]com | Newly registered domain observed on a host associated with hostile infrastructure and a GTA6 lure. |
| DOMAIN | gta6mainweb[.]com | Newly registered domain observed on a host associated with hostile infrastructure and a GTA6 lure. |
| DOMAIN | web12api[.]com | Malicious domain associated with the DocSend sample endpoint and related attacker infrastructure. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe NetSupport Manager payload used a scheduled task to reinstall itself.T1059.001 · PowerShellWindows ClickFix instructions launched an encoded PowerShell command that fetched a loader.T1059.004 · Unix ShellmacOS ClickFix instructions launched a piped zsh command chain.T1105 · Ingress Tool TransferThe PowerShell chain fetched a loader, which downloaded encrypted payloads; later stages downloaded password-protected archives.T1543.003 · Windows ServiceThe NetSupport Manager payload established persistence with a Windows service.T1547.001 · Registry Run Keys / Startup FolderThe Ledger wallet payload created a Run key named Ledger Wallet Installer.T1553.004 · Install Root CertificateA payload installed a self-signed certificate authority in the system root store.T1557.002 · ARP Cache PoisoningA local proxy, hosts-file entry, and rogue CA enabled interception or manipulation of HTTPS connections.
People
Malware
Vendors
DiscordThe installer in the Windows chain was signed with a certificate stolen from Discord Inc.; the signature did not validate.GoogleGoogle Doc Sidebar Sends Mac and Windows Users Down Different Paths to MalwareLenovoDisguised as a Lenovo driver package, the payload was signed with a genuine stolen Lenovo certificate, the third abused code-signing cert in the chain. The certificate authority it goes on to build is a different thingMicrosoftThe application took advantage of Microsoft's ClickOnce feature to deploy. As Jon put it: "Why write a custom downloader or a full-on installer for an application when you can just use Microsoft to ship it? "
Products
DropBox DocSendactor kept sending our researcher DMs, including a link to another document, this time shared via DropBox DocSend. Once again, macOS and Windows users were routed to different paths: macOS users were sent to anotherGoogle Apps ScriptA demo of the malicious Google Apps ScriptGoogle DocsLedger Liveas the second payload. After creating a Run key named Ledger Wallet Installer, it searched for Ledger Live and Ledger Wallet installations. It hid its bot ID as sixteen hex characters in a file calledMsBuild.exeauthority it goes on to build is a different thing entirely: that one it generates itself. It hollowed MsBuild.exe and imported only kernel32, ultimately establishing what Jon called "purpose-built and working publicNetSupport ManagerManager.zip - NetSupport Manager 14.10.0004TelegramEverything collected was sent directly to the threat actor via the Telegram API; the script sent a beacon message for each of the action codes below.