Threat actors abuse Google Apps Script in evasive phishing attacks

Threat actors are abusing Google Apps Script to host realistic, credential-harvesting phishing pages on script.google.com. Emails with invoice or tax lures lead victims to the Google-hosted fake login, capture credentials which are exfiltrated, and then redirect victims to the legitimate site to reduce suspicion; security teams are advised to scrutinize or block Google Apps Script URLs and adjust email security policies.