Google Apps Script Abuse: Phishing, Fraud, Malware and CSAM Risks Identified in TraceX Labs Report

TraceX Labs has published a new threat intelligence report examining the abuse of Google Apps Script Web Apps in phishing, fraud, malware distribution, SEO manipulation, spam, suspected CSAM/CSE-related activity and malicious redirection.

The report, identified as GLOBAL-026 and dated September 30, 2026, has been classified with a High threat assessment and an Active / Monitoring status. The research examines how publicly accessible Google Apps Script Web Apps may be incorporated into larger campaigns involving malicious or abusive content.

Google Apps Script abuse examined by TraceX Labs

TraceX Labs notes that Google Apps Script is a legitimate platform used for software development, automation, education, data processing and Google Workspace workflows. The report focuses on third-party abuse of the infrastructure rather than suggesting that malicious functionality is inherent to Google Apps Script.

According to the report, Apps Script Web Apps can process HTTP requests, generate HTML, handle parameters, interact with external resources and participate in redirect workflows. These capabilities can potentially make an Apps Script URL one component of a larger campaign.

A campaign may begin through a search engine, social media platform, email or messaging service before directing a user to an Apps Script URL. The URL can then lead to a landing page, dynamic application or redirector before reaching external infrastructure.

Phishing, fraud and malware distribution

The TraceX Labs investigation covers phishing and credential harvesting, malicious APK distribution, malware delivery, malicious redirects and social engineering.

The report also examines investment scams, employment scams, fake payment pages, UPI-related fraud, cryptocurrency-related fraud and impersonation campaigns.

As part of the investigation, TraceX Labs documented Apps Script-associated infrastructure involving APK downloads, malware-related landing pages and redirects toward suspicious payload infrastructure. The report classifies the relevant evidence as Observed / Correlated rather than assuming that all Apps Script deployments are malicious.

The report also identifies indicators associated with suspected investment and employment scams, including payment requests, requests for personal information, unrealistic salary claims and external messaging-platform contacts.

SEO manipulation and spam

Search-engine abuse is another major area examined in the report.

TraceX Labs identifies potential indicators including keyword-heavy landing pages, doorway pages, automatically generated pages, large numbers of outbound links, repeated page templates, redirect chains, affiliate links and campaign-specific URLs.

Where search visibility is deliberately manipulated, the report notes that the activity may correspond to MITRE ATT&CK T1608.006, Stage Capabilities: SEO Poisoning.

The investigation also covers Google video/search spam and movie-piracy-related search infrastructure. According to the report, these ecosystems can potentially contain advertising, redirects, malvertising or malware-delivery infrastructure.

Gambling, adult spam and synthetic media

The report examines additional categories including gambling and betting spam, adult/NSFW spam, drug-related search spam and deepfake or synthetic-media-related spam.

TraceX Labs documented investigated infrastructure involving gambling keywords, casino promotions, affiliate links and redirects. It also examined campaigns combining adult-content and gambling-related material.

The investigation also covers deepfake and synthetic-media-related activity, including manipulated-media claims, fake celebrity content, synthetic-media services and external distribution platforms.

TraceX Labs cautions that the presence of individual keywords does not automatically establish illegal activity. Context, destination infrastructure and other evidence are required for classification.

Suspected CSAM and child exploitation infrastructure

The report includes a separate section examining suspected CSAM/CSE-related infrastructure.

TraceX Labs classifies this evidence as Suspected / Corroboration Required,and describes the category as requiring enhanced evidence handling. The report recommends that investigators avoid unnecessarily downloading, reproducing or redistributing underlying material and that public reports contain only appropriately redacted evidence.
The report also treats NCII and sextortion as separate sensitive investigative categories. These categories are presented as potential impact classifications and do not mean that every Apps Script deployment investigated by TraceX Labs is associated with them.

Google domain does not guarantee a safe destination

One of the report's central findings is that a Google-owned URL should not automatically be considered trustworthy simply because it uses a Google domain.

TraceX Labs states that a Google-hosted URL does not establish that Google created or endorsed the content, operates the final destination or that the external infrastructure is trustworthy.

The report also points out that HTTPS provides encrypted communication but does not itself establish that the content or destination is legitimate.

What security teams should monitor

TraceX Labs recommends monitoring Apps Script URLs based on their behaviour and surrounding infrastructure rather than blocking Google services as a whole.

Recommended indicators include suspicious URLs, repeated deployment IDs, unusual parameters, redirect chains, known malicious destinations, downloaded APKs, suspicious files, credential submissions and unusual browser or endpoint activity.

The report further recommends correlating Apps Script URLs with destination domains, IP addresses, ASNs, certificates, URL parameters, file hashes and related infrastructure. Multiple independent indicators can help security teams prioritize investigations.

TraceX Labs calls for behavioural analysis

The report highlights several limitations, including the extensive legitimate use of Google Apps Script, changing search-engine indexing, rapidly disappearing infrastructure, redirect behaviour that can vary by user-agent or location, and possible false positives from reputation services.

TraceX Labs recommends using classifications such as Observed, Correlated, Suspected, Potential, Benign and Unknown so that technical capabilities are not incorrectly presented as confirmed malicious activity.
In its final assessment, TraceX Labs describes trusted cloud infrastructure abuse as a significant threat-intelligence and defensive-detection challenge. The report identifies potential links between Apps Script infrastructure and campaigns involving phishing, fraud, malware distribution, SEO poisoning, spam, malicious redirection, NCII, sextortion and suspected CSE/CSAM-related activity.

The recommended investigation model is Discover/Validate/Correlate/Classify/Report, with behaviour, content, destination and campaign relationships considered alongside the hosting provider's reputation.

The complete GLOBAL-026 Threat Intelligence Report is available on TraceX Labs at:

https://tracexlabs.com/reports/google-apps-script-abuse-threat-report-2026.html