Malicious Google Apps Script Sidebar Fingerprinting via Google Doc

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•4

Detects web traffic directed towards Google Apps Script endpoints that exhibit characteristics of malicious activity, specifically targeting browser-side data collection and user interaction lures. The rule identifies potential phishing attempts by correlating access to Google Apps Script pages (e.g., sidebars or add-ons) with external document-based referrers (e.g., Google Docs) or social media referrers, combined with scripts that attempt to exfiltrate user device environment data, location, or cryptocurrency wallet information.