Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Signed ClickOnce Installer Uses Google Workspace Decoy to Deploy Credential Stealers and RAT
Excerpt
A targeted fake-job campaign compromised a cryptocurrency organization after an employee was approached through LinkedIn while changing jobs. The attacker posed as a recruiter for a fictitious Web3 protocol, arranged interviews through Calendly, and sent a technical assessment disguised as a Google Sheet. The assessment page was hosted through Google Apps Script and used genuine Google assets, making it look like a normal Workspace document. It displayed a “Candidate…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://gapidriver.com/installer/GapiUpdate.application | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…