Google-Hosted Apps Script Pages Used to Profile Crypto Victims

A recent cyberattack has exposed how Google-hosted Apps Script pages can be used to profile cryptocurrency victims before delivering signed Windows malware.

The campaign targeted a employee at a cryptocurrency organization who was publicly seeking new work. A fake recruiter initiated contact through LinkedIn and arranged interviews via Calendly, ultimately sharing what appeared to be a technical assessment in Google Sheets.

The 'assessment' turned out to be a malicious Google Apps Script web app masquerading as a Workspace document. It collected visitor telemetry, including IP address, approximate geolocation, ISP, operating system, browser characteristics, and installed wallet extensions.

The payload was delivered through a signed ClickOnce deployment manifest, GapiUpdate.application, served from gapidriver[.]com. The application rendered a legitimate Google Workspace Marketplace page while executing its malicious staging logic in the background.