A fake biotech conference used prominent scientists’ names to lure life science professionals into a malware campaign.Image credit:©iStock.com, peshkovBilled as two days of biotech programming without corporate keynotes or investor panels, BioTold 2026 seemed like an exciting addition to Boston’s bustling biotech calendar. Its website promised “the first biotech conference where every speaker is a working practitioner.” Slated for November 5–6 at the Omni Boston Hotel at the Seaport, the conference boasted an opening keynote by Harvard University geneticist George Church, an advisory board featuring Nobel laureate Carolyn Bertozzi of Stanford University, and sponsorships from industry titans like Thermo Fisher Scientific.But the event is an elaborate fiction. A cybersecurity firm Proofpoint told the Boston Business Journal that the website is an online front for cybercriminals seeking to trick life science professionals into downloading malicious software.The Fabricated LineupAt first glance, BioTold’s multi-page website appeared remarkably convincing, complete with detailed programming and schedules, pricing tiers, and a pledge to share “real, first-person stories” from the bench. But the façade quickly unraveled when the Boston Business Journal contacted high-profile names on the roster to investigate Proofpoint’s claims.A Wyss Institute spokesperson confirmed to the publication that Church was not speaking at BioTold. Representatives for Broad Institute researchers Feng Zhang and Pardis Sabeti likewise denied any affiliation with the event. Daphne Koller, chief executive officer of insitro, a drug company, also told the publication she knew nothing about the conference and had no role in it.Continue reading below…Like this story? Sign up for FREE Newsletter updates:Latest science news storiesTopic-tailored resources and eventsCustomized newsletter contentSubscribeThree of the listed corporate sponsors—Thermo Fisher Scientific, Illumina, and Agilent Technologies—confirmed they were neither sponsoring nor otherwise involved in the event.Invitations Deliver MalwareWhile the site offered early-bird conference tickets for $149 and corporate sponsorship packages up to $25,000, Proofpoint said the operation was not merely designed to collect registration fees. Instead, the website served as elaborate camouflage for a targeted phishing campaign—a cyberattack where scammers use deceptive emails to trick victims into downloading malicious software. Proofpoint first became aware of the fraudulent speaking invitations in June, according to Selena Larson, a threat researcher at the company. The attack unfolded in stages. Scammers first emailed life science professionals inviting them to speak at or sponsor the event. The website lent the invitations a veneer of legitimacy, making recipients more comfortable engaging with the operation. Once an invitee expressed interest, the attackers sent a follow-up message containing a URL that led to a malware download. While the report does not specify how this secondary link was disguised to the victim—whether framed as a speaker packet, scheduling tool, or registration form—generally clicking it would deliver the malware payload.Proofpoint told the Boston Business Journal that the campaign is linked to a cybercriminal group they have been tracking as TA586. Larson described the group as an “initial access broker for ransomware,” explaining that ransomware threat actors have used infections linked to TA586 to deliver malware. Ransomware can lock organizations out of their own data until a sum is paid. The article also reported that cybercriminals exploit emotional hooks such as excitement or fear to lure their targets. In BioTold’s case, the prospect of speaking at an industry event was the bait. “What’s interesting about this particular actor is, they have these very elaborate websites that try to look real. So, in these cases, you really have to stop and think: Is this something I was expecting?” Larson told the publication.The Prestige TrapLast month, a Nature investigation described a related scheme involving sham scientific societies.1 These organizations bestow unsolicited, fee-free honors on prominent researchers while offering memberships and awards to early-career researchers for a fee. Education-policy specialist Fan Xiudi told Nature that the societies appeared to be building a “facade of legitimacy” to sell memberships and awards, particularly to early-career researchers in China.The apparent recognition can be flattering. Columbia University computer scientist Julia Hirschberg was elected to one such academy, then another just days later. “I was really excited,” she told Nature. “I’ve never had anything that quick happen ever.”Larson advises scientists to pause and independently verify unexpected job offers and speaking invitations. She recommends avoiding suspicious sites and using tools such as Whois to check a website’s domain and registrar information. To verify an invitation, she suggests checking with trusted contacts or calling the organizers using contact information from an official website. She also urges anyone who has interacted with BioTold to inform their IT team as a precaution.If an invitation promises to be “the conference we always wished existed,” it might not exist at all, she told the Boston Business Journal.
Click Here For The Original Source.
——————————————————–
