Signed ClickOnce Installer Uses Google Workspace Decoy to Deploy Credential Stealers and RAT

A targeted fake-job campaign compromised a cryptocurrency organization after an employee was approached through LinkedIn while changing jobs.

The attacker posed as a recruiter for a fictitious Web3 protocol, arranged interviews through Calendly, and sent a technical assessment disguised as a Google Sheet.

The assessment page was hosted through Google Apps Script and used genuine Google assets, making it look like a normal Workspace document.

It displayed a “Candidate Verification” prompt and a fake connector error, GAPI-CON-212. Victims were told they needed to install a Google API helper to continue.

That helper was not legitimate. It was a signed Microsoft ClickOnce application called GapiUpdate.application, hosted on gapidriver[.]com.

Once opened, the installer used Windows ClickOnce components, including rundll32.exe, dfshim.dll, and dfsvc.exe, to deploy the malicious application under the logged-in user’s profile.

The installer was code-signed with an SSL.com certificate issued to a real Norwegian organization. There is no evidence the named company knowingly participated.

The certificate could have been abused, stolen, or obtained through fraudulent identity records. Signed malware remains dangerous because code signing can reduce user suspicion and may help a malicious file bypass basic trust checks.

Signed ClickOnce Delivers Dual Malware

The ClickOnce application displayed a legitimate Google Workspace Marketplace page inside WebView2 while working in the background.

At the same time, it profiled the system by checking running processes, security software, analysis tools, screen resolution, and other host details.

It then contacted an attacker-controlled endpoint at gapidriver[.]com/api/get.php. The server response provided a password-protected Dropbox archive named Razo.rar. The archive contained three Windows executables disguised as PNG files.

Each file used several layers of encryption, packing, shellcode, and in-memory loading to hide its final payload. The malware chain used custom “Vortex” containers, encrypted shellcode, and Donut-based in-memory execution.

This allowed the final payloads to run without saving their full executable files in a normal form on disk. The incident resulted in private-key theft and a wallet drain across six blockchain networks.

The attacker reportedly repaid lending positions to release collateral, swapped tokens, bridged funds to Ethereum, and consolidated roughly 22.6 Ether into a staging wallet.

This was not a simple wallet-approval scam. The transactions were directly signed from the victim’s account, indicating the attacker likely obtained the private key, seed phrase, or wallet-access material from the infected device.

The impact goes beyond cryptocurrency losses. The Rust stealer can collect credentials and tokens that may give attackers access to cloud platforms, source-control systems, deployment tools, VPNs, password managers, CI/CD systems, and production environments.

A compromised developer workstation should therefore be treated as a full identity compromise, haveibeensquatted said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR