---
title: "Hackers abuse Google Apps Script to steal credit cards, bypass CSP"
author: "Martin Hawksey"
date: 2021-02-19T12:49:24+00:00
modified: 2021-02-19T12:50:20+00:00
canonical_url: https://pulse.appsscript.info/p/2021/02/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/
markdown_url: https://pulse.appsscript.info/p/2021/02/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp.md
categories:
  - "Community News"
tags:
  - "@serghei"
  - "bleepingcomputer.com"
featured_image: https://pulse.appsscript.info/files/2021/02/Google-Apps-Script.jpg
description: "Interesting report highlighting how Google Apps Script is being exploited as a vector to skim card data. The post is worth reading for more details but in short the script.google.com address for webapps is being used as a trusted domain to avoid detection. The post also mentions how Google Analytics is being used for a similar exploit.  How this will all play out is yet to be seen."
---

# Hackers abuse Google Apps Script to steal credit cards, bypass CSP

![Hackers abuse Google Apps Script to steal credit cards, bypass CSP](https://pulse.appsscript.info/files/2021/02/Google-Apps-Script.jpg)

> [https://www.bleepingcomputer.com/news/security/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/](https://www.bleepingcomputer.com/news/security/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/)Image: Google
> Attackers are abusing Google’s Apps Script business application development platform to steal credit card information submitted by customers of e-commerce websites while shopping online.

Interesting report highlighting how Google Apps Script is being exploited as a vector to skim card data. The post is worth reading for more details but in short the script.google.com address for webapps is being used as a trusted domain to avoid detection. The post also mentions how Google Analytics is being used for a similar exploit.  How this will all play out is yet to be seen.

Source: *[Hackers abuse Google Apps Script to steal credit cards, bypass CSP*](https://www.bleepingcomputer.com/news/security/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/)

---

*Published by [Martin Hawksey](https://pulse.appsscript.info/p/author/admin/) on [Pulse](https://pulse.appsscript.info/). Original article: [https://pulse.appsscript.info/p/2021/02/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/](https://pulse.appsscript.info/p/2021/02/hackers-abuse-google-apps-script-to-steal-credit-cards-bypass-csp/)*