FHN 
A sophisticated cryptocurrency-focused campaign is abusing trusted Google services as part of a multi-stage attack designed to identify valuable targets and deliver Windows malware.
The operation begins with what appears to be a legitimate Web3 recruitment process. Attackers approach potential victims through professional networking platforms, conduct interviews, and later provide a technical assessment. Instead of receiving a genuine assignment, the victim is directed to a malicious application built with Google Apps Script.
The campaign combines social engineering, victim profiling, signed Windows software, and multiple malware families to ultimately gain access to sensitive information and cryptocurrency assets.
A Fake Recruitment Process Opens the Door
The attackers reportedly used LinkedIn to establish contact with potential victims before moving conversations into a seemingly normal hiring process.
After arranging interviews through Calendly, victims were given a technical task hosted through Google services. The page was designed to look like a legitimate Workspace-based document, making the request less suspicious.
Behind the familiar interface was a Google Apps Script application controlled by the attackers.
Before attempting to install malware, the application gathered technical information about visitors. This included details such as IP address, approximate location, internet service provider, operating system, browser environment, and the presence of cryptocurrency wallet extensions.
Wallets including MetaMask, Phantom, Rabby, Keplr, OKX, Coinbase Wallet, and Trust Wallet were among those checked.
The attackers also recorded how visitors interacted with the page and forwarded activity information to Telegram channels under their control.
Fake Verification Error Delivers the Next Stage
After profiling the victim, the malicious page displayed a fake “Candidate Verification” prompt.
A fabricated GAPI-CON-212 error was then presented as a technical problem that supposedly required the victim to install a Google API component.
The requested software was not a legitimate helper. It was a signed Windows ClickOnce application named GapiUpdate.application.
The application was hosted through gapidriver[.]com and used WebView2 to display a convincing Google Workspace-related interface while carrying out additional activity in the background.
Using digitally signed software adds another layer of deception. Users may be more willing to trust an application when Windows identifies it as being signed, while basic security controls that heavily rely on publisher reputation may also be less effective.
The analyzed sample was version 1.0.0.201 and used an SSL.com-issued certificate associated with a Norwegian organization. Investigators have not found evidence that the organization was knowingly involved in the operation.
The certificate may have been obtained through compromised signing credentials, misuse of an organization’s identity, or another form of certificate abuse.
Malware Delivered in Disguised Files
Following installation, GapiUpdate communicated with the attacker’s infrastructure and retrieved further instructions. This resulted in the download of a password-protected archive called Razo.rar, hosted on Dropbox.
The archive contained files that appeared to be PNG images but were actually Windows executables.
The malware loader renamed the files and executed them separately, introducing delays between launches. This approach can make the activity appear less connected and potentially complicate detection and investigation.
Three distinct payloads were identified.
One was NeedleStealer, which focused heavily on information associated with browsers, cryptocurrency wallets, messaging applications, and screenshots.
Another Rust-based stealer expanded the collection capabilities, targeting browser data, desktop wallets, password managers, VPN and SSH credentials, cloud configurations, development tools, source-control accounts, messaging platforms, and selected files.
The third component was a Go-based remote access trojan. It provided attackers with persistent access and capabilities such as command execution, file manipulation, proxying, keylogging, in-memory operations, and VNC-based remote control.
Attackers Moved Quickly to Steal Cryptocurrency
The campaign was not limited to information gathering.
Investigators linked the operation to the theft of cryptocurrency following the compromise of private keys. Assets were reportedly taken across six blockchains in a short period.
The attackers also moved funds between networks, including transfers to Ethereum, and eventually consolidated approximately 22.6 ETH into a staging wallet.
The sequence of activity indicates that the attackers were able to obtain access to wallet credentials or private keys rather than relying solely on traditional transaction-approval phishing.
Campaign Shows Wider Abuse of Trusted Services
The activity is connected to a broader collection of campaigns using the GAPI_Update theme and similar delivery techniques.
These operations demonstrate how attackers can combine legitimate cloud platforms with social engineering to make malicious infrastructure appear trustworthy. Google Apps Script, Workspace-style pages, ClickOnce applications, and ClickFix techniques can each serve a different stage of the infection process.
Attribution also remains difficult. Researchers have noted similarities with multiple cryptocurrency-focused threat operations, including activity linked to malware-as-a-service ecosystems and techniques previously observed in campaigns targeting digital assets.
What Organizations Should Watch For
Security teams should pay particular attention to unexpected software requests that appear during recruitment, interviews, technical assessments, or other professional communications.
Indicators associated with this campaign include:
GapiUpdate.applicationgapidriver[.]com- ClickOnce artifacts located under
%LOCALAPPDATA%\Apps\2.0 - The
DeviceSetupManagerscheduled task - Outbound TCP traffic involving
91.219.238.169:5556
A compromised workstation used for software development or cryptocurrency operations should be considered high risk. Organizations should investigate potentially exposed browser sessions, wallet credentials, cloud accounts, source-control tokens, SSH credentials, and other secrets, followed by appropriate containment and credential rotation.
The campaign is a reminder that trusted platforms can be turned into effective delivery mechanisms when combined with convincing social engineering. For organizations handling cryptocurrency, source code, or other high-value digital assets, security controls need to look beyond the reputation of the service being used and focus on the behavior occurring around it.
About the Author
