Threat actors have been seen abusing Google Apps Script to launch convincing phishing attacks and steal people’s Microsoft 365 login details.

Google Apps Script is a cloud-based scripting platform that lets users automate tasks and extend Google Workspace apps like Gmail, Docs, Sheets, and Drive using JavaScript.