If you are a malicious hacker, cybersecurity professionals may very well be the worst people in the world to try to hack, as there is a very good chance they are going to catch you.

A person pretending to work for a leading crypto news site targeted several cybersecurity professionals around the time of the hacking conferences Black Hat and Def Con earlier this month. The hacker approached attendees on social media site X, both via public replies and DMs, and then leveraged Google Docs in an attempt to trick the targets into installing malware, according to researchers. 

On Wednesday, security firm Huntress published a blog post detailing the hacking campaign, which targeted one of its researchers, who pretended to go along with it to learn what the hacker was trying to do. 

In broken English, the hacker asked the researcher if they had plans to attend a conference next, and then mentioned a conference allegedly organized by the crypto news website, according to a screenshot of the conversation.

After that, the hacker shared a legitimate Google Doc that looked like it was a planning document for the fake conference. The document displayed a sidebar designed to make the target think it was encrypted. The goal was to first trick the target into entering a fake decryption key provided by the hacker. That was the first step in a process that would lead to the installation of malware for macOS and Windows, depending on the operating system used by the target, according to Huntress.

To make the sidebar appear real, the hacker used Google App Script, a platform that allows developers to customize the user interface of Google Docs with menus and sidebars, for example.

The hacker tried to trick Huntress’ researcher into installing an infostealer for Apple computers; a remote desktop viewing tool repurposed as malware for Windows; and a fake installer for the cryptocurrency wallet Ledger.  

The person behind the account identified by Huntress researchers as the hacker did not respond when TechCrunch sent them a private message on X. 

Hackers of all kinds — be them unknown government hackers using advanced spyware, or North Korean government hackers using fake Twitter profiles — have targeted cybersecurity professionals before. What made this campaign a bit more believable was the use of a legitimate Google Doc and Google feature. 

Google did not immediately when TechCrunch reached out asking if the company had seen this hacking campaign, or similar ones.

Mark Zuckerberg just bought a cozy abode close to Meta’s international headquarters in Ireland. By cozy abode, we mean a castle. Zuck bought the 19th-century Strancally Castle and its 440-acre grounds, an estate estimated to have cost him anywhere from $23 million to $35 million.

“Mark and his family are excited to continue caring for this historic home and look forward to spending time in Ireland, where Meta maintains its international headquarters,” a spokesperson told the press about the purchase.

We’ve reached out to Meta for further comment.  

The home is stunning: it sits on a river, surrounded by greenery, and the Irish Times reported in 2001 that it has at least 11 bedrooms, four tower suites, a library, a dining room, and a drawing room. Zuck bought the castle from a financier who’d lived there with his family for 25 years. 

Meta’s international headquarters is in Dublin, where the company opened a 31,000-square-foot data center in 2017, 20 minutes from the city. Waterford, where Zuck’s new castle is, is about a two-hour drive from Dublin.

This isn’t Zuck’s first big real estate purchase this year. He and his wife also reportedly splashed out $170 million for a home in the same exclusive Miami neighborhood as Jeff Bezos, joining a slew of tech billionaires leaving California as the state seeks to implement a form of wealth tax. 

On Wednesday night, Runlayer and Rippling dropped their respective lawsuits against each other. No settlement was made. No money changed hands. Not even lawyers’ fees, according to court documents seen by TechCrunch.

Rippling celebrated by instantly releasing its MCP gateway, the product at the heart of the dueling lawsuits and the one that competes with Runlayer’s offering.

This public fight is a cautionary tale to founders: In the age of AI, when building new software has become almost trivial, you never know who your next competitor will be. It might even be a prospective customer.

To recap the short-lived legal brouhaha: Runlayer is an early-stage startup that launched out of stealth in November, 2025 and has raised a total of $42 million from VCs like Khosla Ventures’ Keith Rabois and Felicis. It’s led by third-time founder Andrew Berman (previous companies: baby-monitor maker Nanit and an AI video conferencing tool, Vowel, that sold to Zapier in 2024).

After Rippling tested Runlayer’s MCP gateway for more than a year, with the two engineering teams working closely together, Rippling never signed on to become a customer, according to Runlayer’s lawsuit. Instead, Berman received a text from a Rippling employee that said his employer was building its own MCP gateway and planned to release it as a product. This employee described Rippling’s product as a clone of Runlayer’s.

Runlayer sued, claiming that Rippling violated contractual agreements covering the tests of its products.

An MCP gateway securely handles an enterprise’s AI agent requests for data from other software systems. So, for instance, when a hiring professional asks for details on the top five candidates for a job, including their emails, that data must be retrieved from the company’s recruitment system. The gateway handles the retrieval process, rather than granting agents direct access to the company’s software systems. It can then also layer on other features like employee role-based access control (managers getting different access than interns), observability (logs and usage trails) and so on.

Then Rippling countersued, alleging that Runlayer was violating some of its patents. The move was seen by Runlayer as a way to induce it to drop its suit while ratcheting up legal expenses.

Runlayer dropped its suit after spending the last three weeks in discovery. Rippling also dropped its own suit and again, didn’t collect a settlement either.

So, while the lawsuits didn’t lead to anything but a lot of public flaming, there is a deeper takeaway for founders. The AI landscape is changing so rapidly that the long-running technical shoot-outs that enterprises love to impose on startups need to be rethought. Between the time an AI startup enters into one and however-many months later, an enterprise’s needs and desires may have drastically changed.

In the meantime, in the span of weeks, Rippling, who’s bread and butter has historically been payroll and benefits management, has now entered the AI Gateway market with a tool that can route to different models while dashboarding token spend by employee. The product is competing with the likes of Stripe, Ramp and Databricks.

Now Rippling is also in the AI security business with this MCP gateway that ties AI access to employee roles. It competes with the likes of Runlayer, Docker and Amazon Bedrock.

As for Runway, its pitch is a broader bundle of agent security services tied to the gateway, ranging from agent creation to spotting shadow AI agents running in an enterprise unbeknownst to IT.