Tradecraft Tuesday | Borrowed Faces, Borrowed Certs: Inside a Post-DEF CON Malware Campaign

Days after Black Hat and DEF CON, a threat actor slid into a Huntress researcher's DMs posing as a crypto conference exec. Our researcher saw through it immediately and strung the actor along to watch the attack play out in real time. What unfolded was a multi-stage campaign built on stolen identity at every turn: a fake social media persona, forged code-signing certificates from real companies, and a rogue certificate authority planted directly on the machine. This session walks through what we watched happen, stage by stage, and why identity and endpoint security can no longer be treated as separate problems.