{"id":4333,"date":"2025-05-31T10:00:15","date_gmt":"2025-05-31T10:00:15","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/05\/31\/threat-actors-leverage-google-apps-script-to-host-phishing-websites\/"},"modified":"2025-05-31T10:00:15","modified_gmt":"2025-05-31T10:00:15","slug":"threat-actors-leverage-google-apps-script-to-host-phishing-websites","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/05\/31\/threat-actors-leverage-google-apps-script-to-host-phishing-websites\/","title":{"rendered":"Threat Actors Leverage Google Apps Script To Host Phishing Websites"},"content":{"rendered":"

Threat Actors Leverage Google Apps Script To Host Phishing Websites
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cybercriminals have escalated their tactics by exploiting Google Apps Script, a trusted development platform, to host sophisticated phishing campaigns that bypass traditional security measures.<\/p>\n

This emerging threat represents a significant shift in how attackers leverage legitimate infrastructure to enhance the credibility of their malicious operations<\/a>.<\/p>\n

The latest campaign targets unsuspecting users through deceptive invoice emails that appear to originate from legitimate disability and health equipment providers.<\/p>\n

These carefully crafted messages contain minimal content to avoid triggering spam filters while creating urgency that prompts immediate action from recipients.<\/p>\n

The attackers deliberately exploit the inherent trust users place in communications that appear business-related and time-sensitive.<\/p>\n

Cofense analysts identified<\/a> this sophisticated phishing operation through their Phishing Defense Center, revealing how threat actors have weaponized Google\u2019s own infrastructure to create an illusion of authenticity.<\/p>\n

By hosting malicious content on script.google.com domains, attackers effectively circumvent many security solutions that typically whitelist Google services<\/a>, making detection significantly more challenging for both automated systems and end users.<\/p>\n

The campaign\u2019s impact extends beyond simple credential theft, as successful attacks provide cybercriminals with access to corporate email systems and sensitive organizational data.<\/p>\n

The use of Google\u2019s trusted environment dramatically increases the likelihood of successful compromise, as users are conditioned to trust Google-hosted content without scrutiny.<\/p>\n

Multi-Stage Infection Mechanism<\/strong><\/h2>\n

The attack unfolds through a carefully orchestrated sequence designed to maximize victim engagement while minimizing suspicion.<\/p>\n

\n
\"\"
Email Body (Source -Cofense)<\/figcaption><\/figure>\n<\/div>\n

Initial infection begins when recipients click the \u201cView Invoice\u201d link in the spoofed email, which redirects them to a Google Apps<\/a> Script-hosted page displaying what appears to be a legitimate electronic fax download interface.<\/p>\n

\n
\"\"
Fake Invoice Page (Source -Cofense)<\/figcaption><\/figure>\n<\/div>\n

The critical transition occurs when users click the \u201cPreview\u201d button, triggering the deployment of a fraudulent login window that mimics authentic Microsoft authentication<\/a> interfaces.<\/p>\n

\"\"
Phishing Page (Source -Cofense)<\/figcaption><\/figure>\n

Once credentials are entered, a PHP script immediately captures and transmits the data to attacker-controlled servers before seamlessly redirecting victims to a legitimate Microsoft login page<\/a> to maintain the deception.<\/p>\n

\n
\"\"
Final redirect page (Source -Cofense)<\/figcaption><\/figure>\n<\/div>\n

This final redirection serves as psychological camouflage, leaving victims unaware that their credentials have been compromised while providing attackers with immediate access to corporate systems and sensitive information.<\/p>\n

Celebrate 9 years of ANY.RUN!\u00a0Unlock the full power of<\/strong>\u00a0TI Lookup plan (100\/300\/600\/1,000+ search requests),\u00a0and\u00a0your request quota will double<\/a>.<\/strong><\/p>\n

The post Threat Actors Leverage Google Apps Script To Host Phishing Websites<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Threat Actors Leverage Google Apps Script To Host Phishing Websites Cybercriminals have escalated their tactics by exploiting Google Apps Script, a trusted development platform, to host sophisticated phishing campaigns that bypass traditional security measures. This emerging threat represents a significant shift in how attackers leverage legitimate infrastructure to enhance the credibility of their malicious operations. […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-4333","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/4333"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=4333"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/4333\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=4333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=4333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=4333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}