Spies in the Spreadsheet: “Sheet Attack” Uses Google Sheets & AI to Target India

Zscaler ThreatLabz exposed a targeted cyber-espionage campaign called “Sheet Attack” against Indian government entities that abuses trusted cloud services (notably Google Sheets) as a command-and-control channel. The campaign uses a C# backdoor named SHEETCREEP, alongside FIREPOWER (PowerShell/Firebase) and MAILCREEP, and shows ties to a Pakistan-linked actor with signs of generative AI-assisted malware development.