# Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware

Malicious Google Apps Script sidebar in a shared Doc beacons victim IP/geolocation/wallet extensions to Telegram, then ClickFix lures deliver AMOS stealer on macOS and a signed PowerShell loader chain on Windows.

- Payout: Real-world hack
- Severity: high
- Program: Google
- Analysis by: Huntress
- Disclosed: 2026-09-15
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/google-doc-sidebar-malware-mac-windows
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-google-doc-sidebar-malware-mac-windows
- Tags: area:os domain:desktop domain:web impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:high technique:chained technique:recon vuln:secrets-leak

**Target:** Google Doc with container-bound Apps Script sidebar; macOS/Windows endpoints
**Root cause:** A container-bound Google Apps Script runs client-side in the viewer's browser without an OAuth consent prompt, so merely opening the shared Doc executes attacker code that beacons recon data to Telegram and renders a fake decryption-failure sidebar with ClickFix commands.
**Steps:**
1. Attacker shares a real Google Doc link plus an 'access key' via X DM posing as CoinDesk marketing.
2. Victim opens the Doc; the bound Apps Script runs client-side, no OAuth prompt, sending a VIEW beacon with public IP, geolocation, browser, and detected crypto wallet extensions (MetaMask/Ethereum, Phantom, Tron, Solana) to the Telegram API.
3. Sidebar shows a fake decryption failure with OS-specific remediation: copy-paste Terminal commands (ClickFix) or a 'manual update' button.
4. macOS: pasted zsh chain pipes to shell, or victim downloads a DMG from the actor's GitHub repo with Gatekeeper-bypass instructions and a password prompt; payload is an AMOS stealer variant harvesting browser, wallet, Telegram, Apple Notes, cookie and keychain data.
5. Windows manual path: fake 'Google API Connector' update launches an app signed with a stolen Norwegian company cert, deployed via ClickOnce, with a decoy Google Workspace Marketplace portal while malware downloads.
6. Windows ClickFix path: encoded PowerShell fetches a loader pulling three encrypted payloads, showing a fake progress bar.
7. Second lure via Dropbox DocSend: macOS gets same AMOS host; Windows gets a DocSend installer signed with a stolen Discord cert (invalid signature) plus a 5-screen decoy onboarding carousel.
8. Loader captures a desktop screenshot, fetches three password-protected archives from `eu03hub[.]com/get_file` with the password in the C2 response, launches each detached/hidden then again with `Start-Process -Verb RunAs`.
9. Payloads: NetSupport Manager RMM (persistence via keyboard filter driver, service, Run key, scheduled task), a fake Lenovo driver package signed with a genuine stolen Lenovo certificate that builds a TLS-intercepting local proxy that installs a self-signed CA posing as Google Trust Services CN=WR3 plus a www.virustotal.com leaf cert, hosts entry and LocalProxy firewall rule, and a Ledger wallet implant polling the actor's server.
**How found:** Huntress researcher recognized the X DM lure, engaged the actor without executing malware, and analyzed the Doc's Apps Script beacons; when the DocSend sample's endpoint returned 404, analysts pivoted to sibling infrastructure on web12api[.]com and rebuilt the registration protocol from the sample's own @sentry/electron module to recover stage-three payloads.
**Exploitation:** Recon-first funnel: the Apps Script grades targets by IP/geo/wallet presence, then OS-tailored ClickFix or signed-download paths deliver AMOS (credential/wallet theft) on macOS and a multi-stage loader on Windows ending in rogue RMM persistence, a locally-trusted CA enabling interception of wallet/AV domains, and a Ledger implant awaiting commands.
**Escalation:** Rogue CA in the system root store plus hosts entry and firewall rule lets the operator MITM any HTTPS domain (wallets, AV updates) without cert warnings; CA regenerated per host defeats thumbprint blocking; the CA, hosts entry, and firewall rule persist while the process dies at reboot.
**Insight:** Container-bound Google Apps Scripts execute on document open with no OAuth prompt, so a shared Doc is executable content: treat Doc links from unknown senders as code execution and open them signed out to strip the collection layer.