AI Weekly Malaysia

A threat actor impersonated a crypto news outlet on X, messaging security researchers around Black Hat and Def Con 2026 about a fake conference. They sent a legitimate Google Doc with a fake 'encrypted' sidebar built using Google Apps Script, tricking targets into entering a provided decryption key that initiated malware installation — an infostealer on macOS and a repurposed remote desktop tool on Windows. Huntress published the full writeup after one of its researchers played along to observe the attack chain.

Why: The attack technique — using Google Apps Script to render fake UI elements like an 'encrypted' sidebar inside a real Google Doc — is reproducible and could be aimed at non-security targets too. If you or your team share Google Docs externally or build Apps Script add-ons, recognize that the Docs UI can be customized to display misleading security indicators, and treat any 'enter this decryption key' prompt in a shared doc as suspicious.

Kaspersky reports new modules in the Cavern C2 framework, used by Iranian-linked group Cavern Manticore against Israeli entities. The toolkit now uses DNS A-record responses to switch between direct HTTPS and a Google Apps Script relay, and a module called HOLLOWGRAPH abuses Microsoft 365 calendar events via the Graph API as a covert two-way C2 channel, dating events to 2050 to avoid detection.

Why: Unless you are building or defending SaaS APIs that could be abused as relay or dead-drop infrastructure (Google Apps Script, Microsoft Graph calendar), this has little direct impact on your work. The concrete takeaway for platform/security builders: legitimate cloud services like Google Apps Script and M365 Graph are increasingly used to hide malicious traffic, so rate-limiting and monitoring of script deployment IDs and calendar event anomalies may be worth reviewing.