黑客虚构 BioTold 2026 生物会议并冒用波士顿奥姆尼酒店名义实施诈骗

Skift Take

With prominent scientists, corporate sponsors, and a Boston hotel venue, the conference website looked legitimate. The scam is a reminder that the professional credibility of speaking at a meeting can be weaponized by criminals. 

A biotech conference scheduled for November in Boston appeared to have everything needed to attract an influential audience: Nobel Prize-winning scientists, major corporate sponsors, a prestigious hotel and an agenda promising insights from leading researchers.

There was just one problem. The conference didn’t exist.

According to cybersecurity company Proofpoint, BioTold 2026, advertised for November 5–6 at the Omni Boston Hotel at the Seaport, was an elaborate front for a cybercriminal operation targeting life sciences professionals.

The scam wasn’t just about money, though. It used the promise of professional exposure and networking opportunities to persuade prospective speakers and sponsors to download malicious software, according to Proofpoint. Attackers contacted life sciences professionals with invitations to speak at or sponsor the fictional conference. Once recipients expressed interest, the attackers followed up with links designed to deliver malware.

Traditional event scams exploit legitimate conferences through fraudulent hotel bookings, fake registration websites, or impersonated organizers. BioTold reversed that model. Rather than attaching a scam to an existing event, the criminals created the event itself, using the promise of participation to target potential victims.

Omni Confirms Its Name Was Used Without Authorization

Omni Hotels & Resorts confirmed to Skift Meetings that the Boston property had no connection to BioTold 2026.

“BioTold 2026 was not an event organized, hosted, or affiliated with Omni Boston Hotel at the Seaport,” said Caitlin Beveridge, senior director of communications and public relations for Omni Hotels & Resorts.

“Upon learning that the property’s name was being used to promote the event without authorization, the hotel promptly involved its legal team and took appropriate action.”

Beveridge said the hotel was not involved in organizing or promoting the event and had no additional information about its planning or operations.

The case highlights another dimension of conference fraud: A venue’s reputation can be exploited without its knowledge. Prospective speakers, sponsors, and attendees may assume that an event advertised at a well-known property has undergone some level of verification.

A Conference Built to Deceive

BioTold’s website, which has been taken down, advertised a speaker lineup that included Harvard geneticist George Church, Nobel laureate Carolyn Bertozzi, and other prominent researchers.

Major life sciences companies, including Thermo Fisher Scientific, Illumina and Agilent Technologies, appeared among its sponsors.

Registration reportedly started at $149, while corporate sponsorship packages reached $25,000.The website included detailed schedules, speaker information, and other elements typical of a professional conference.

But when the Boston Business Journal investigated, representatives for several advertised speakers and sponsors denied any involvement.

Proofpoint attributes the activity to TA586, a cybercriminal threat actor associated with gaining initial access to computer systems that ransomware operators can later exploit.

Making Cybersecurity a Top Priority in the Planning Process

For Ben Taylor, vice president and chief resilience officer at security consulting firm Gate 15, the BioTold operation is another reminder of the persistent cybersecurity threats facing the events industry.

He doesn’t necessarily view BioTold as evidence of escalating cyber threats. Ransomware incidents and claims involving convention centers in North America have demonstrated that the meetings industry is a target. However, he believes meeting planners need to prioritize cybersecurity awareness.

One of the most important steps planners can take is to make cybersecurity awareness a responsibility shared across their organizations, says Taylor.

“I’d just encourage them to try to raise the awareness of these threats amongst their entire teams,” he said.

As fraudulent conferences become more convincing, organizers need to determine how speakers and sponsors can independently verify invitations, sponsorship solicitations and other official communications. Organizers can also aim to establish clearly identified communication channels for speaker invitations and sponsorship opportunities.

October is Cybersecurity Awareness Month, a public awareness initiative supported by the Cybersecurity and Infrastructure Security Agency and the National Cybersecurity Alliance.

The campaign offers educational materials and reminders about basic cybersecurity practices that organizations can share with employees. For meeting professionals, those practices include independently verifying unexpected speaking invitations, checking unfamiliar event websites, and confirming requests for sensitive information through trusted communication channels.

While the BioTold scam will fade from memory, the broader lesson is that conference fraud is no longer limited to fake registration websites, counterfeit tickets, or fraudulent hotel booking services.

In this case, the entire conference was counterfeit, and its most valuable asset wasn’t a ticket. It was trust.

In addition to preying on participants, scammers have gone after meeting planners, too. Learn how to protect yourself from becoming a victim here.