Fake Google Workspace MSIX Uses App Installer Configuration to Run Remote PowerShell

Nov 3, 2026 · Original article ↗

Summary

Researchers analyzed a signed fake “Google Workspace” MSIX that uses an .appinstaller file to obtain a server and ID, then runs server-supplied PowerShell via WebView2. The final payload was unavailable; a traffer connection is only a suspected fit.

Key points

The fake “Google Workspace” MSIX is signed with a Sectigo EV certificate issued to Croatian company CODE LOFTS d.o.o.; the signature does not establish that the software is genuine.
An 868-byte .appinstaller file supplies the package’s server address and an 8-character ID, allowing the same signed MSIX to be reused with different hosts or links.
The app exits if it lacks the recorded App Installer address, which can make the bare package appear harmless in some sandbox runs.
The app opens a WebView2 window and checks the loaded address for a query parameter containing base64-encoded PowerShell, which it runs with a hidden PowerShell process.
A fake Google documentation page serves as a decoy while a one-line download cradle fetches and executes another PowerShell stage from driverwinupdate[.]live.
Researchers could not retrieve the third stage or identify a malware family; a traffer-team operating model is a possible fit, not a confirmed attribution.
The article recommends alerting on the PowerShell execution pattern and suspicious MSIX/WebView2 behavior, and blocking the identified domains and certificate.

Article Details

Attack Vectors: A fake “Google Workspace Installer” is delivered as an MSIX package signed with an EV certificate issued in the name of CODE LOFTS d.o.o.; the package is installed through a .appinstaller file.
The installed app reads its server address and 8-character campaign ID from the recorded .appinstaller address, opens a WebView2 page, and executes base64-decoded PowerShell supplied in a query parameter.
The PowerShell downloader retrieves a further script from driverwinupdate[.]live/WinService and executes it in memory. The researchers could not retrieve that stage or determine the final payload.
The article says the setup is consistent with traffer-team activity but explicitly states that this is not proof of who operated it.
Defensive Notes: Install Google Workspace apps only from google.com, and stop if the publisher shown by Windows App Installer does not match the product.
Alert on Invoke-RestMethod … | Invoke-Expression in PowerShell script-block logs (Event ID 4104), and on powershell.exe launched with -NoProfile -ExecutionPolicy Bypass -Command by a packaged app, especially AppName.exe.
Monitor WebView2 requests matching /<8 characters>/redirect from newly installed MSIX packages, over HTTP or HTTPS.
Block workspacedriver[.]live, driverwinupdate[.]live, microsoftnonoficialworkspacefordifferentstuff[.]live, and the reported certificate; hunt for .appinstaller files whose URI path begins with an 8-character folder.
Keep the ms-appinstaller: protocol disabled by default and consider restricting App Installer through policy where it is not needed.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`docs[.]microsoftnonoficialworkspacefordifferentstuff[.]live`	Attacker-used redirect destination displaying a fake Google documentation page while carrying the hidden PowerShell command.
DOMAIN	`driverwinupdate[.]live`	Payload-delivery domain from which the PowerShell downloader retrieves the next stage.
DOMAIN	`workspacedriver[.]live`	Attacker-controlled host serving the malicious .appinstaller and MSIX and supplying the app's server address.
SHA1	`f84036806715099004b1f59802b78c2a97162ec1`	SHA-1 of the EV signing certificate used for the fake Google Workspace package; the article says to block the certificate.
SHA256	`566e52d5176791c792a434a1bd30e949ff2a0a133a68cba296b91867e1fd335f`	SHA-256 of AppName.dll, the malicious package's launcher logic.
SHA256	`5a9bc66291c21a60a36d84284f4d6a19758b6d3ddee69c0caa06390af66fd270`	SHA-256 of the encoded stage-2 PowerShell script.
SHA256	`b51b3d4e170c3c0e1ca43baf5a6e40ff4e2856881fac401e11583cb0aba2235e`	SHA-256 of the malicious .appinstaller configuration file.
SHA256	`e5634f9e2668fffdaffe257bbe4d8eee07c02fb9435fe82c753387f544f87cf0`	SHA-256 of the malicious MSIX package.
URL	`hxxp[:]//driverwinupdate[.]live/WinService`	Stage-delivery URL called by the PowerShell downloader to retrieve and execute additional PowerShell.
URL	`hxxps[:]//docs[.]microsoftnonoficialworkspacefordifferentstuff[.]live/`	Attacker-used decoy page that copies Google documentation and carries the hidden command in its address.
URL	`hxxps[:]//workspacedriver[.]live/nbdt423a/app[.]appinstaller`	Malicious App Installer configuration URL that supplies the package, runtime dependency, server address, and campaign ID.
URL	`hxxps[:]//workspacedriver[.]live/nbdt423a/msixx[.]msix`	URL serving the malicious, signed MSIX package.
URL	`hxxps[:]//workspacedriver[.]live/nbdt423a/redirect`	Malicious redirect endpoint that loads the page containing the encoded PowerShell command.