Targeted Cryptocurrency Intrusion Reveals Vulnerabilities in Google-Hosted Apps Script Pages
In a recently uncovered cyberattack, a coordinated intrusion targeting cryptocurrency aspirations showcases how Google-hosted Apps Script pages can be maliciously exploited to meticulously profile potential victims before subsequently deploying signed Windows malware. This sophisticated campaign leverages a facade of a fictitious Web3 recruitment process, demonstrating the lengths to which attackers will go to deceive their targets.
The malicious operation employed a three-payload stack that included NeedleStealer, a Rust-based infostealer not officially classified, and a custom Remote Access Trojan (RAT) built in Go, featuring concealed Virtual Network Computing (VNC) capabilities. These payloads were effectively concealed within the trappings of a recruitment strategy, where a fake recruiter initially made contact through LinkedIn, creating an air of legitimacy. The interactions proceeded through the arrangement of interviews on Calendly, culminating in the distribution of what ostensibly seemed to be a technical assessment via Google Sheets.
Rather than a genuine evaluation, what victims encountered was a malicious Google Apps Script web application masquerading as an innocuous Workspace document. Operating within Google’s familiar landscape, the interface not only appeared legitimate but also utilized assets from Google domains, cleverly obtaining critical telemetry from its visitors. This included their IP address, approximate geolocation, Internet Service Provider (ISP), operating system details, browser characteristics, and even information about installed wallet extensions, such as MetaMask, Phantom, Rabby, Keplr, OKX, Coinbase Wallet, and Trust Wallet.
Intriguingly, the malware recorded every interaction with the app—page loads, update clicks, retries, and downloads—transmitting this data back to the attackers through Telegram chats under their control. Victims encountered a deceptive overlay titled “Candidate Verification” and were subsequently met with a fabricated error message featuring the code GAPI-CON-212. This failure was tactically employed as a pretext to prompt the installation of a supposed Google API helper.
The payload delivered to Windows systems comprised a signed ClickOnce deployment manifest referred to as GapiUpdate.application, which was hosted on gapidriver[.]com. This application cleverly rendered a legitimate Google Workspace Marketplace page via WebView2 while orchestrating malicious activities in the background. This tactic of utilizing a signed installer is particularly noteworthy as it significantly diminishes user skepticism, thereby evading simplistic trust judgments based on publisher reputation.
The analyzed version of the application, labeled 1.0.0.201, bore an SSL.com-issued code-signing certificate linked to a Norwegian organization. However, evidence currently available does not support the notion that this entity was knowingly involved in the operation. The intriguing possibility remains that the signing access could have been compromised or that identity was abused, suggesting fraudulent certificate issuance.
Upon installation, GapiUpdate sought an authenticated configuration from gapidriver[.]com, which responded with a password-protected archive hosted on Dropbox, dubbed Razo.rar. Research by cybersecurity experts from Haveibeensquatted revealed that this attack sought to compromise an employee holding a position at a cryptocurrency organization, an individual who was publicly indicating a desire for new employment shortly after submitting their resignation.
Inside the archive, three files were cleverly masquerading as PNG images, but each began with a Windows executable header. The attacker subsequently renamed these files to randomized .exe titles, executing them with a 60-second delay in between, thus minimizing the chances of detection that typically accompany correlated endpoint events.
The investigation of these payloads confirmed that this operation was not solely focused on digital wallets. NeedleStealer targeted a range of browser credentials, active sessions, wallet extensions, and Telegram data, alongside capturing screenshots. The Rust-based stealer expanded its reach by collecting data linked to browsers, desktop wallets, password managers, VPN and SSH information, cloud configurations, source-control credentials, and various messaging applications.
Moreover, the third payload—a Go-based RAT—allowed persistent, interactive access characterized by encrypted command-and-control channels. Its capabilities included seamless shell access, file management, proxying, keylogging, and visual VNC functionalities. The repercussions of this attack materialized rapidly, with investigations confirming key compromise and asset theft spanning six blockchains in less than an hour. The perpetrators engaged in repaying lending positions to unlock collateral, swapping assets, and bridging the proceeds into Ethereum, ultimately consolidating around 22.6 Ether into a newly designated staging wallet.
This operational pattern indicates direct theft of keys rather than traditional phishing tactics. Additionally, the campaign shares similarities with the broader GAPI_Update ecosystem as reported by Security Alliance. This ecosystem has previously utilized fake Google Workspace pages, Apps Script-based lures, ClickOnce deliveries, and a variety of sophisticated techniques against cryptocurrency targets.
Experts from SEAL have cautioned that such activities cannot be solely attributed to a single threat actor; rather, they reflect a convergence of tactics often associated with Russia-based trafficking and malware-as-a-service operations, frequently overlapping with campaigns linked to North Korean actors.
As a precautionary recommendation to defenders, any ClickOnce installation stemming from unsolicited recruitment processes should be categorized as high risk. Personnel are advised to focus their investigative efforts on GapiUpdate.application, gapidriver[.]com, ClickOnce artifacts under the %LOCALAPPDATA%\Apps\2.0 directory, the DeviceSetupManager scheduled task, and outbound raw-TCP connections to the IP address 91.219.238.169:5556. Organizations with affected developers or crypto workstations should operate under the assumption that their browser sessions, wallet keys, cloud credentials, source-control tokens, and deployment secrets could be compromised.
The synthesized narrative surrounding this targeted intrusion offers a stark reminder of the evolving threat landscape in which cybercriminals exploit legitimate platforms and processes, necessitating heightened vigilance in operational security across all sectors.