Cross-Platform Malware Campaign via Malicious Google Doc Sidebar

A social engineering campaign, identified by the Huntress SOC, targets users through X (formerly Twitter) direct messages. Attackers lure victims into interacting with a malicious Google Doc, which utilizes a sidebar mechanism to facilitate the delivery of secondary payloads. The campaign exhibits platform-aware capabilities, distinguishing between macOS and Windows operating systems to deliver distinct malware. Windows-based targets receive an installer for NetSupport Manager, a legitimate remote access tool repurposed for malicious activity. Simultaneously, macOS users are targeted with Atomic macOS Stealer (AMOS), an information stealer designed to extract browser data, credentials, and cryptocurrency wallet information. This campaign highlights the use of legitimate collaborative platforms to bypass perimeter defenses and social engineering to drive user interaction.

Attack Chain

1. Attacker sends a direct message via X containing a link to a Google Doc.
2. Victim accesses the Google Doc, which features a malicious sidebar element.
3. Victim clicks an embedded link or interacts with the document, triggering an external redirection.
4. The delivery platform performs an operating system check via browser user-agent headers.
5. Windows targets are prompted to download and execute an installer containing NetSupport Manager.
6. macOS targets are served a malicious payload that triggers the execution of Atomic macOS Stealer (AMOS).
7. NetSupport Manager establishes C2 communication to grant the attacker remote control.
8. AMOS exfiltrates sensitive data, including local browser files and credentials, to attacker infrastructure.

Impact

The campaign facilitates unauthorized remote access to Windows systems and comprehensive credential and data exfiltration from macOS systems. Victims face risks ranging from long-term persistence and system compromise to the theft of financial assets and private keys stored on infected machines.

Recommendation

Deploy endpoint detection mechanisms capable of identifying the execution of remote access tools and unauthorized credential access. Audit organizational policies regarding the use of external Google Docs shared via unsolicited direct messages. Prioritize the investigation of suspicious network connections associated with remote support software if not explicitly permitted by IT policy.