Google Workspace — CraftedSignal Threat Feed

ClickFix 'BackgroundFix' Campaign Delivers CastleLoader, NetSupport RAT, and CastleStealer

hello@craftedsignal.io — Thu, 30 Apr 2026 13:00:00 +0000

The BackgroundFix campaign is a social engineering scheme using fake “remove your photo background” services to deliver malware. Victims are lured to malicious sites mimicking legitimate image editing tools. The sites feature fake upload interfaces, progress bars, and download buttons to appear authentic. This campaign delivers a multi-stage payload, starting with CastleLoader. CastleLoader then drops NetSupport RAT, enabling remote access for the attackers, and CastleStealer, a custom .NET stealer designed to exfiltrate browser credentials, wallet extension data, and Telegram session files. This campaign appears to be active, with multiple domains sharing the same template.

Attack Chain

Victim searches for an online background removal tool and lands on a malicious BackgroundFix site.
The victim uploads an image to the fake website.
After clicking a checkbox, the site instructs the victim to copy a command to their clipboard.
The copied command executes finger.exe to query cheeshomireciple[.]com
finger.exe retrieves a batch script from the C2 server.
The batch script executes commands to download and execute further payloads.
CastleLoader is deployed, subsequently dropping NetSupport RAT and CastleStealer.
NetSupport RAT grants the attacker remote access, while CastleStealer exfiltrates sensitive data.

Impact

Successful attacks result in the installation of NetSupport RAT, granting attackers remote control over the compromised system. Additionally, CastleStealer exfiltrates sensitive information such as browser credentials, wallet extension data, and Telegram session files. This stolen data can be used for further malicious activities, including financial fraud, identity theft, and unauthorized access to sensitive accounts. The active nature of the campaign and the use of multiple domains suggest a broad targeting scope.

Recommendation

Monitor process creation events for the execution of finger.exe with command-line arguments pointing to external domains (IOC: cheeshomireciple[.]com).
Deploy the Sigma rule to detect the execution of finger.exe to identify potential initial access attempts.
Block the C2 domain cheeshomireciple[.]com at the DNS resolver to prevent initial payload delivery.
Monitor network connections for NetSupport RAT C2 communications on port 688 to detect compromised systems (IOCs: poronto[.]com:688, giovettiadv[.]com:688).

Google Workspace Login Attempt with Government Attack Warning

hello@craftedsignal.io — Tue, 28 Apr 2026 00:48:14 +0000

This alert focuses on identifying potentially malicious login attempts within Google Workspace environments. The detection is based on Google’s own flagging of a login as a potential “gov_attack_warning,” suggesting that Google’s threat intelligence attributes the activity to a government-backed actor. While specific targeting information is unavailable, this alert highlights a critical area for investigation within organizations utilizing Google Workspace, especially those handling sensitive data or operating in sectors of interest to nation-state actors. This detection provides an early warning of potential compromise or data exfiltration attempts.

Attack Chain

Initial Access: An attacker attempts to log into a Google Workspace account using compromised or brute-forced credentials.
Login Attempt: The login attempt triggers a “gov_attack_warning” within Google Workspace, indicating a potential government-backed threat actor.
Privilege Escalation (Potential): If the compromised account has elevated privileges, the attacker may attempt to escalate privileges within the Google Workspace environment.
Defense Evasion (Potential): The attacker may attempt to disable security features or modify audit logs to evade detection.
Persistence (Potential): The attacker may establish persistent access through methods such as creating rogue apps or modifying account settings.
Data Access: The attacker gains access to sensitive data stored within Google Workspace, such as documents, emails, and files.
Exfiltration (Potential): The attacker exfiltrates the stolen data to an external location.
Impact: The organization suffers a data breach, reputational damage, and potential financial losses.

Impact

A successful attack could lead to the compromise of sensitive data within the Google Workspace environment, including confidential documents, emails, and other business-critical information. The potential consequences range from reputational damage and legal liabilities to financial losses and disruption of business operations. The number of affected users and the severity of the impact will depend on the scope of the attacker’s access and the sensitivity of the compromised data.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect “gov_attack_warning” events in Google Workspace logs.
Investigate any triggered alerts promptly, focusing on the affected user account and associated activity.
Review the Google Workspace audit logs for any suspicious activity leading up to the “gov_attack_warning” event.
Implement multi-factor authentication (MFA) for all Google Workspace accounts, especially those with elevated privileges.
Monitor Google Workspace activity logs for suspicious patterns, such as unusual login locations, failed login attempts, and changes to account settings.

Google Workspace Suspicious Login Activity

hello@craftedsignal.io — Fri, 26 Jan 2024 10:00:00 +0000

This brief focuses on detecting suspicious login activity within Google Workspace environments, as flagged by Google’s internal risk assessment mechanisms. Google Workspace logs login events and classifies them based on various risk factors, including the use of less secure applications, programmatic logins, and other anomalies. This detection capability is crucial for identifying potential compromises, unauthorized access attempts, and malicious activities within the Google Workspace ecosystem. Analyzing these flagged events allows security teams to proactively respond to threats before they escalate, preventing data breaches and maintaining the integrity of sensitive information. This alert focuses on logins classified as ‘suspicious_login_less_secure_app’, ‘suspicious_login’, and ‘suspicious_programmatic_login’.

Attack Chain

Initial Access: An attacker gains initial access using compromised credentials or brute-force techniques targeting Google Workspace accounts.
Login Attempt: The attacker attempts to log in to a Google Workspace account using a less secure application (e.g., an older email client without modern authentication) or via programmatic login.
Suspicious Activity Detection: Google’s internal systems analyze the login attempt and flag it as suspicious based on various risk factors, such as unusual location, time of day, or login method.
Event Logging: Google Workspace logs the suspicious login event, including the reason for the classification (e.g., ‘suspicious_login_less_secure_app’).
Potential Privilege Escalation: Upon successful login, the attacker may attempt to escalate privileges within the Google Workspace environment to gain broader access.
Defense Evasion: The attacker might use techniques to evade detection, such as disabling security features or modifying audit logs.
Persistence: The attacker establishes persistence by creating new accounts, modifying existing ones, or installing malicious apps.
Data Exfiltration/Malicious Activity: The attacker uses the compromised account to exfiltrate sensitive data or perform other malicious activities, such as sending phishing emails.

Impact

Successful exploitation can lead to unauthorized access to sensitive data stored within Google Workspace, including emails, documents, and other files. This can result in data breaches, financial loss, and reputational damage. The number of affected users depends on the scope of the compromised account and the attacker’s ability to escalate privileges. Targeted sectors are broad, affecting any organization relying on Google Workspace for collaboration and data storage.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect suspicious login activity classified by Google Workspace (logsource: gcp, service: google_workspace.login).
Investigate any alerts generated by the Sigma rule to determine the legitimacy of the login attempt and take appropriate action, such as resetting passwords or disabling compromised accounts.
Enforce multi-factor authentication (MFA) for all Google Workspace accounts to mitigate the risk of credential compromise.
Disable or restrict the use of less secure apps within Google Workspace to reduce the attack surface.
Monitor Google Workspace audit logs for other suspicious activities, such as unusual file access or data exfiltration attempts.

Detection of Out-of-Domain Email Forwarding in Google Workspace

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This brief focuses on detecting unauthorized email forwarding to external domains within Google Workspace environments. The primary concern is the potential for data exfiltration or misuse by malicious insiders or threat actors who have compromised user accounts. The activity is logged by Google Workspace and can be monitored using the Google Workspace Admin Reports API. The event name associated with this activity is email_forwarding_out_of_domain, which is generated when a user configures automatic email forwarding to an address outside the organization’s domain. Successful exploitation of this technique can lead to the leakage of sensitive information, intellectual property theft, or compliance violations.

Attack Chain

An attacker gains unauthorized access to a Google Workspace user account, potentially through phishing, credential stuffing, or other methods.
The attacker navigates to the Gmail settings for the compromised account.
The attacker configures automatic email forwarding to an external email address controlled by the attacker (e.g., a Gmail, Outlook, or ProtonMail address).
The attacker sets up filters to forward specific types of emails, such as those containing sensitive keywords or originating from key personnel.
Legitimate emails are received by the compromised user and automatically forwarded to the external address.
The attacker collects the forwarded emails, extracting sensitive data or using it for further malicious activities.
The attacker covers their tracks by deleting audit logs or modifying forwarding rules.

Impact

Successful exploitation of unauthorized email forwarding can lead to significant data breaches, intellectual property theft, and compliance violations. The impact can range from exposure of sensitive customer data to the loss of competitive advantage due to stolen trade secrets. Depending on the volume and nature of the data exfiltrated, organizations may face legal and regulatory penalties, as well as reputational damage.

Recommendation

Deploy the provided Sigma rule to your SIEM to detect email_forwarding_out_of_domain events in Google Workspace logs (logsource: gcp, service: google_workspace.login).
Investigate any alerts generated by the Sigma rule to determine the legitimacy of the email forwarding configuration.
Implement multi-factor authentication (MFA) for all Google Workspace accounts to reduce the risk of account compromise.
Regularly review and audit email forwarding rules to identify and remove any unauthorized configurations.
Train users to recognize and report phishing attempts to prevent account compromise.