Malicious Google Apps Script Sidebar Triages Victim OS/Geo/Wallets

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•2

Detects network requests to script.google.com that include a specific action parameter indicating potential interaction with Google Apps Script web macros. Attackers often use Google Apps Script as a proxy or webhook for C2 communication, data exfiltration, or to serve malicious payloads due to its reputation and ease of use in bypass scenarios.