Carson said that he initially believed the phishing attack essentially just copied and pasted the Google Apps Script code from his GitHub page or from snippets of the code in his blog post. But ...

The code editor is available in the Chrome browser and the official Apps Script website details how the scripts run on Google servers.

Threat actors have been seen abusing Google Apps Script to launch convincing phishing attacks and steal people’s Microsoft 365 login details.

Attackers are abusing Google's Apps Script business application development platform to steal credit card information submitted by customers of e-commerce websites while shopping online.

Google Apps Scripts are a relatively easy way for marketers to dip their toes in the automation waters.