Sansec logo

Google Apps Script used to steal data


by Sansec Forensics Team

Published in Threat Research − February 18, 2021

Google Apps Script used to steal data

The Google business application platform Apps Script is used to funnel stolen personal data, Sansec learned. Attackers use the reputation of the trusted Google domain to evade malware scanners and trust controls like CSP.

Researcher Eric Brandel used Sansec's Early Breach Detection data to analyze this new attack pattern. In step 1, attackers inject a small piece of obfuscated code into an ecommerce site:

In step 2, the malware intercepts payment forms and sends the data to a custom application hosted at Google Apps Script:

The actual code hosted at Google is not public, but this error message suggests that intercepted personal data is funneled by Google servers to an Israel-based site called (step 3):

The malware domain was registered on the same day as previously discovered malware domains and, who are also hosted on the same network.

This new threat shows that merely protecting web stores from talking to untrusted domains is not sufficient. E-commerce managers need to ensure that attackers cannot inject unauthorized code in the first place. Server-side malware and vulnerability monitoring is essential in any modern security policy.

Read more

Read more

Scan your store now
for malware & vulnerabilities

$ curl | sh

eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce and many more.

Stay up to date with the latest eCommerce attacks

Sansec logo

experts in eCommerce security


Terms & Conditions
Privacy & Cookie Policy
Company Reg 77165187
Tax NL860920306B01