Malicious Google Apps Script Profiles Crypto Victims Before Delivering Signed Windows Malware

A targeted cryptocurrency intrusion has exposed how Google-hosted Apps Script pages can be weaponized to profile prospective victims before delivering signed Windows malware.

The campaign used a fake Web3 recruitment process to deploy a three-payload stack: NeedleStealer, an unclassified Rust infostealer, and a custom Go RAT with hidden VNC capabilities.

A fake recruiter initiated contact through LinkedIn, arranged interviews via Calendly, and ultimately shared what appeared to be a technical assessment in Google Sheets.

The “assessment” was instead a malicious Google Apps Script web app masquerading as a Workspace document.

Google-hosted interface used legitimate assets from Google domains while collecting visitor telemetry, including IP address, approximate geolocation, ISP, operating system, browser characteristics, and installed wallet extensions such as MetaMask, Phantom, Rabby, Keplr, OKX, Coinbase Wallet, and Trust Wallet.

It also reported interactions including page loads, update clicks, retries, and downloads to attacker-controlled Telegram chats.

Victims were presented with a “Candidate Verification” overlay and a fabricated GAPI-CON-212 connector error. The failure became the pretext for installing a supposed Google API helper.

On Windows, the payload was a signed ClickOnce deployment manifest, GapiUpdate.application, served from gapidriver[.]com.

The application rendered a legitimate Google Workspace Marketplace page through WebView2 while executing its malicious staging logic in the background.

The signed installer is particularly notable because it lowers user suspicion and can evade simplistic trust decisions based on publisher reputation.

The analyzed build, version 1.0.0.201, carried an SSL.com-issued code-signing certificate naming a Norwegian organization; however, available evidence does not show that the named entity knowingly participated.

Possible explanations include stolen signing access, identity abuse, or fraudulent certificate issuance.

Once installed, GapiUpdate requested an authenticated configuration from gapidriver[.]com, which returned a Dropbox-hosted, password-protected archive named Razo.rar.

Haveibeensquatted Researchers said that, attackers targeted an employee at a cryptocurrency organization who was publicly seeking new work after handing in notice.

The archive contained three files disguised as PNG images, but each began with a Windows MZ executable header.

Malicious Google Apps Script Attack

The stager renamed them to randomized .exe files and launched them with a 60-second delay between executions, reducing the likelihood that correlated endpoint events would be recognized as one infection chain.

The recovered payloads demonstrate that this was not a wallet-only operation. NeedleStealer targeted browser credentials, sessions, wallet extensions, Telegram data, and screenshots.

The Rust stealer broadened the collection scope to browsers, desktop wallets, password managers, VPN and SSH material, cloud configurations, source-control credentials, developer tooling, messaging applications, and targeted files.

The third payload, a Go-based RAT, provided persistent interactive access through encrypted raw-TCP command-and-control, shell access, file management, proxying, keylogging, in-memory execution, visible VNC, and hVNC.

The operational impact was immediate. Investigators reported private-key compromise followed by asset theft across six blockchains in roughly one hour.

The attackers repaid lending positions to unlock collateral, swapped assets, bridged proceeds to Ethereum, and later consolidated about 22.6 Ether into a staging wallet.

This behavior indicates direct key theft rather than conventional approval phishing.

The campaign overlaps with the wider GAPI_Update ecosystem tracked by Security Alliance, which has used fake Google Workspace pages, Apps Script-based lures, ClickOnce, and ClickFix delivery paths against cryptocurrency targets.

SEAL cautions that such activity cannot be confidently assigned to a single actor: Russia-based traffer and malware-as-a-service operations have adopted tactics strongly associated with DPRK-linked cryptocurrency campaigns.

For defenders, a ClickOnce installation spawned from an unsolicited recruitment workflow should be treated as high risk.

Hunting should prioritize GapiUpdate.application, gapidriver[.]com, ClickOnce artifacts under %LOCALAPPDATA%\Apps\2.0, the DeviceSetupManager scheduled task, and outbound raw-TCP connections to 91.219.238.169:5556.

Any affected developer or crypto workstation should be assumed to have exposed browser sessions, wallet keys, cloud credentials, source-control tokens, and deployment secrets.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now