Google Apps Script Abuse: Phishing, Fraud, Malware and CSAM Risks Identified in TraceX Labs Report
TraceX Labs has published a new threat intelligence report examining the potential abuse of Google Apps Script Web Apps in phishing, fraud, malware distribution, SEO manipulation, spam, malicious redirection and suspected CSAM/CSE-related activity.
The report, designated GLOBAL-026 and dated September 30, 2026, carries a High threat assessment with an Active / Monitoring status. It examines how publicly accessible Google Apps Script Web Apps may be incorporated into larger campaigns involving malicious or abusive content.
Google Apps Script Abuse Examined
TraceX Labs emphasizes that Google Apps Script is a legitimate platform used for software development, automation, education, data processing and Google Workspace workflows. The report focuses on third-party abuse of legitimate infrastructure, rather than suggesting that malicious functionality is inherent to Google Apps Script.
According to the report, Apps Script Web Apps can process HTTP requests, generate HTML, handle parameters, interact with external resources and participate in redirect workflows. These capabilities can potentially allow an Apps Script URL to become one component of a larger campaign.
A campaign may begin through a search engine, social media platform, email or messaging service before directing a user to an Apps Script URL. The URL can then lead to a landing page, dynamic application or redirector before reaching external infrastructure.
Phishing, Fraud and Malware Distribution
The investigation covers phishing and credential harvesting, malicious APK distribution, malware delivery, malicious redirects and social engineering.
TraceX Labs also examines investment scams, employment scams, fake payment pages, UPI-related fraud, cryptocurrency-related fraud and impersonation campaigns.
As part of the investigation, TraceX Labs documented Apps Script-associated infrastructure involving APK downloads, malware-related landing pages and redirects toward suspicious payload infrastructure.
The report classifies relevant evidence as Observed / Correlated, rather than assuming that all Apps Script deployments are malicious.
The investigation also identifies indicators associated with suspected investment and employment scams, including payment requests, requests for personal information, unrealistic salary claims and external messaging-platform contacts.
SEO Manipulation and Spam
Search-engine abuse is another major area examined in the report.
TraceX Labs identifies potential indicators including keyword-heavy landing pages, doorway pages, automatically generated pages, large numbers of outbound links, repeated page templates, redirect chains, affiliate links and campaign-specific URLs.
Where search visibility is deliberately manipulated, the report notes that the activity may correspond to MITRE ATT&CK T1608.006, Stage Capabilities: SEO Poisoning.
The investigation also covers Google video/search spam and movie-piracy-related search infrastructure. According to the report, these ecosystems can potentially contain advertising, redirects, malvertising or malware-delivery infrastructure.
Gambling, Adult Spam and Synthetic Media
The report examines additional categories including gambling and betting spam, adult/NSFW spam, drug-related search spam and deepfake or synthetic-media-related spam.
TraceX Labs documented investigated infrastructure involving gambling keywords, casino promotions, affiliate links and redirects. It also examined campaigns combining adult-content and gambling-related material.
The investigation covers deepfake and synthetic-media-related activity, including manipulated-media claims, fake celebrity content, synthetic-media services and external distribution platforms.
TraceX Labs cautions that the presence of individual keywords does not automatically establish illegal activity. Context, destination infrastructure and other evidence are required for classification.
Suspected CSAM and Child Exploitation Infrastructure
The report includes a separate section examining suspected CSAM/CSE-related infrastructure.
TraceX Labs classifies this evidence as “Suspected / Corroboration Required” and describes the category as requiring enhanced evidence handling.
The report recommends that investigators avoid unnecessarily downloading, reproducing or redistributing underlying material. Public reports should contain only appropriately redacted evidence.
The report also treats NCII and sextortion as separate sensitive investigative categories. These categories are presented as potential impact classifications and do not mean that every Apps Script deployment investigated by TraceX Labs is associated with them.
Google Domain Does Not Guarantee a Safe Destination
One of the report's central findings is that a Google-owned URL should not automatically be considered trustworthy simply because it uses a Google domain.
TraceX Labs states that a Google-hosted URL does not establish that Google created or endorsed the content, operates the final destination or that the external infrastructure is trustworthy.
The report also points out that HTTPS provides encrypted communication but does not itself establish that content or a destination is legitimate.
What Security Teams Should Monitor
TraceX Labs recommends monitoring Apps Script URLs based on their behaviour and surrounding infrastructure rather than blocking Google services as a whole.
Recommended indicators include suspicious URLs, repeated deployment IDs, unusual parameters, redirect chains, known malicious destinations, downloaded APKs, suspicious files, credential submissions and unusual browser or endpoint activity.
The report further recommends correlating Apps Script URLs with destination domains, IP addresses, ASNs, certificates, URL parameters, file hashes and related infrastructure.
Multiple independent indicators can help security teams prioritize investigations and distinguish potentially abusive deployments from legitimate applications.
TraceX Labs Calls for Behavioural Analysis
The report highlights several limitations, including the extensive legitimate use of Google Apps Script, changing search-engine indexing, rapidly disappearing infrastructure, redirect behaviour that can vary by user-agent or location, and possible false positives from reputation services.
TraceX Labs recommends using classifications such as Observed, Correlated, Suspected, Potential, Benign and Unknown so that technical capabilities are not incorrectly presented as confirmed malicious activity.
In its final assessment, TraceX Labs describes trusted cloud infrastructure abuse as a significant threat-intelligence and defensive-detection challenge.
The report identifies potential links between Apps Script infrastructure and campaigns involving phishing, fraud, malware distribution, SEO poisoning, spam, malicious redirection, NCII, sextortion and suspected CSE/CSAM-related activity.
The recommended investigation model is:
Discover → Validate → Correlate → Classify → Report
The approach considers behaviour, content, destination and campaign relationships alongside the reputation of the hosting provider.
GLOBAL-026 Threat Intelligence Report
The complete GLOBAL-026 Threat Intelligence Report is available on TraceX Labs: