Phishing campaign at Black Hat and DEF CON used Google Docs and Apps Script — no zero-day needed

An attacker targeted cybersecurity professionals at August 2026's Black Hat and DEF CON using a legitimate Google Doc with a fake encryption sidebar built via Apps Script. Entering a supplied "decryption key" launched AMOS infostealer on macOS or NetSupport RAT on Windows. Huntress disclosed the campaign August 19. TechCrunch reports the lure surpassed prior nation-state campaigns in convincingness.