Product

Google Docs

1 mentions in 7 days · 3 in 30 days · 3 total · first seen Aug 17, 2026 · last 4d ago

Timeline3 articles

Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Huntress analysts trace one X direct message into separate Mac and Windows malware chains delivering AMOS infostealer and NetSupport Manager RAT.

Huntress SOC analysts dissected a malware campaign distributed via an X direct message styled as a Google Docs sidebar. macOS users were routed to the AMOS infostealer, while Windows users received NetSupport Manager remote access malware. The write-up details how a single message branched into two distinct delivery paths per operating system.

HuntressSep 11, 16:36 UTC · 4d agoMalware in the wild 4 sources

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

Huntress uncovered post-DEF CON phishing via X direct messages using a malicious Google Doc to deliver AMOS and NetSupport RAT malware.

Huntress uncovered a phishing campaign targeting attendees after Black Hat and DEF CON. Attackers used X direct messages pointing to a malicious Google Doc as the delivery vehicle. Payloads include AMOS, a macOS infostealer, and the NetSupport RAT, among other malware.

HuntressAug 19, 13:00 UTC · 27d agoPhishing & fraud

TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks

TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.

Unit 42 identified a TrickBot distribution campaign on November 7-8, 2019, using payroll and annual bonus-themed emails sent from likely compromised .edu addresses through the legitimate SendGrid email delivery service. Emails contained links to Google Docs documents linking to downloader executables hosted on Google Drive, further masked behind SendGrid click-tracking URLs. The downloaders, signed by PERISMOUNT LIMITED and displayed with Microsoft Word icons, show a decoy pop-up and retrieve TrickBot payloads from compromised legitimate domains such as savute[.]in and lindaspryinteriordesign[.]com. The newer TrickBot variant stores its files and configuration under %APPDATA%\cashcore.

Palo Alto Unit 42Aug 17, 13:18 UTC · 29d agoPhishing & fraud

Appears with

vendor Huntress 2 malware AMOS 2 malware TrickBot 1 organization Huntress 1 organization PERISMOUNT LIMITED 1 organization Unit 42 1 product AutoFocus 1 product Cortex XDR 1 product Google Drive 1 product NetSupport Manager 1 product NetSupport RAT 1 vendor Palo Alto Networks 1 vendor SendGrid 1 malware NetSupport RAT 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.