Skip to content
Scammers.com
ImpersonationReviewed

Fake BIOTOLD biotech conference in Boston is a malware front

Proofpoint identified a website for a "BIOTOLD" biotech conference at Boston's Omni Seaport hotel (listed Nov. 5–6, 2026) as fake: a front for a criminal malware group.

First reported
Reports
1

Source: hoodline.com · published

Illustration: Impersonation scams

What happened

Hoodline reported on October 13, 2026, citing the Boston Business Journal, that a website advertising a two-day biotech conference branded BIOTOLD at the Omni Boston Hotel at the Seaport, listed for November 5–6, 2026, is a front for a criminal malware group. Cybersecurity firm Proofpoint identified the site as fake.

According to the report, people who signed up were exposed to malicious software. The hotel is real; there is no indication it was involved.

How the scam works

The site was built to look like a real scientific gathering, with two days of programming and networking at a real venue. Per the Boston Business Journal, it used recognisable names from the biotech world, including references to George Church and to Thermo Fisher and Broad Institute leaders, and falsely listed Nobel laureates as advisers. None of them was involved.

Fake conference invitations work because researchers and executives routinely register for events and open agendas or speaker materials. Hoodline notes Proofpoint has separately described fake conference invitations used in an espionage operation, though that was not tied to BIOTOLD.

Source

Hoodline, "Boston biotech conference website was actually a malware trap, researchers warn" (October 13, 2026), citing the Boston Business Journal.

Red flags

  • A conference you have never heard of that lists famous scientists or Nobel laureates as advisers.
  • Registration that requires downloading files or software.
  • No coverage of the event by the institutions it claims to involve.

If you were targeted

  1. 1Do not download anything from the BIOTOLD site.
  2. 2If you registered or downloaded files, run a security scan and tell your IT or security team.
  3. 3Verify events through the named organisations' own websites before registering.
  4. 4Report suspicious event sites to your security team or to the FBI at ic3.gov.
ReportFraud.ftc.gov FBI IC3 More resources