A biotech conference called BioTold 2026, billed for 5 and 6 November at the Omni Boston Hotel at the Seaport, does not exist. Security firm Proofpoint says criminals invented it to lure speakers and sponsors into downloading malware. For organisers, the lesson is uncomfortable: a convincing event page is now cheap to fake, so yours has to be easy to verify.
What do we actually know about BioTold?
Skift Meetings and a Foley Hoag security briefing agree on the core facts. Proofpoint tracks the group behind the site as TA586, which it describes as an initial access broker for ransomware. The site advertised a first-time, two-day event with early-bird tickets at $149, general admission at $299 and sponsorship packages from $5,000 to $25,000.
The speaker and sponsor lines were the bait. George Church was named as opening keynote and Thermo Fisher Scientific appeared among the sponsors, yet neither, nor the other advisers and sponsors approached, confirmed any involvement. Omni Hotels and Resorts said the event has no connection to the property, that its name was used without permission, and that its legal team is involved.
How did the scam work?
Both reports describe the same sequence. Attackers built a polished website, emailed professionals with invitations to speak or sponsor, and sent anyone who replied with interest to a different link that delivered malware. As Skift reports it, nobody is said to have bought a ticket. The target was the invitee's computer, not their card.
That detail matters, because it changes who is at risk. We usually worry about attendees being tricked into paying for a fake event. Here the marks were the people an organiser would normally court: speakers and sponsors, the audience that hesitates least when a flattering invitation lands in the inbox.
A fake conference needs a website, a hotel name and a speaker list. A real one needs the same three things, which is exactly the problem.
What does this mean for event organisers?
Two things, and the first is defensive. Your own events can be cloned. The ingredients are all public: a venue name, a date, a few recognisable speakers lifted from last year's programme. If a scammer wanted to impersonate your conference, the biggest giveaway would not be the design. It would be the absence of anything a cautious invitee could check independently.
The second is practical. Make verification boring and obvious for the people most likely to be targeted. That means a named human contact on your own domain, a venue contact who will confirm the booking if asked, and speaker confirmations that the speakers themselves have published or shared. Foley Hoag's advice to the recipients of these invitations runs the other way round, and it is worth repeating to your own speakers and exhibitors: confirm through contact details you found yourself, check how old the domain is, and look for independent coverage.
Tired of Fee Announcements? Go Flat
eventcloud charges one subscription with no per-ticket fees, so platform news stops being budget news.
The angle the headlines are missing: your invitees need a safe way in
Most of the coverage focuses on how the criminals got caught. The more useful question for an organiser is what a genuine speaker or sponsor sees when you invite them. If your invitation is an email with a link and nothing else, you look exactly like the scammer, only with better intentions.
A cleaner pattern is to separate the public registration page from the invitation route. Public delegates register on the page everyone can find. Speakers, sponsors and VIPs get a personal invitation, sent from a person they can phone, pointing to a pass that exists only on a private link. eventcloud's registration tools support this: a private-link-only pass for speakers and invitees, with a different form attached to each ticket group, so the speaker form can ask for a short bio and a talk title while the delegate form asks for a name and a dietary requirement. It does not make an invitation unforgeable, and no registration tool can. It does mean a genuine invitee lands somewhere that is plainly part of the event they were told about.
It also helps on the day. Name, ticket type and the answers on a registration form show on screen at check-in, so the person at the desk can see that the speaker in front of them registered through the route you agreed. That is a small control, but it is a real one, and our check-in features are built around it.
A short verification checklist you can send this week
Publish a contact page on your own domain with a named person and a phone number, and tell speakers and sponsors where to find it.
Ask your venue who in their team will confirm your booking, and give that contact to anyone who asks.
Tell invited speakers and sponsors that you will never ask them to download software, open an attachment or install anything to take part.
Keep a dated programme page that names confirmed speakers only, and remove anyone who withdraws.
Give invitees one route in, a personal private link, and say so in the invitation.
Who should not take much comfort from this
eventcloud does not detect fraud, and it does not verify that a person is who they say they are. If your risk is impersonation of your brand across email and social media, the answer is domain monitoring, brand protection and a security team, not a registration form. What a registration platform can do is give genuine invitees a clear, consistent and checkable route to your event, which is a smaller job but a worthwhile one.
The BioTold site has since been taken down, according to Skift. The playbook has not. Somebody, somewhere, is already drafting the next fake conference, and it will have a very nice speaker list.
