Phishing emails are becoming harder to spot, not only for users but also for antispam filters. Attackers increasingly abuse legitimate and trusted services to deliver their messages and links, making them look genuine and helping them slip past security checks. Recently, we received an email written in Japanese that was not detected as spam, and that hid a well-crafted infection chain behind a simple share.google link.

The message pretends to come from a customer who received a damaged product. The sender explains that the item arrived with major internal damage, that they recorded a video of the unboxing and took photos of the damage, and that, since the files were too large to attach, they uploaded them to the link included in the message. The email then politely asks the recipient to review the files and decide on an exchange or a refund:

This kind of message is a classic social engineering trick aimed at businesses: a complaining customer creates a sense of urgency, and checking the “evidence” seems like the natural thing to do, especially for busy customer support and sales teams.

What makes this email interesting is that it was sent through Google AppSheet, a legitimate no-code app platform from Google that can send emails on behalf of its users (note the “Sent from AppSheet” at the bottom of the message). Because the message was actually delivered by Google’s mail servers from the appsheet.com domain, SPF, DKIM and DMARC checks all passed, as you can see from the below email message source headers:

Date: Sun, 18 Oct 2026 17:44:31 -0700
Subject: 配送時に確認された破損について
Reply-To: noreply@appsheet.com
From: 佐藤 愛子 <noreply@appsheet.com>
Received: from mail-qv1-f70.google.com (mail-qv1-f70.google.com [209.85.219.70])
Authentication-Results:
    dkim=pass (2048-bit rsa key sha256) header.d=appsheet.com header.i=@appsheet.com header.s=20251104;
    dmarc=pass (p=quarantine) header.from=appsheet.com;
    spf=pass smtp.mailfrom=372fVagcMBHIdehUfboQffiXUUj.SecYdVedelYhkijXQdai.ehW@appsheet.bounces.google.com smtp.helo=mail-qv1-f70.google.com;
Received-SPF: pass
    (appsheet.bounces.google.com ... _spf.google.com: 209.85.219.70 is authorized to use '372fVagcMBHIdehUfboQffiXUUj.SecYdVedelYhkijXQdai.ehW@appsheet.bounces.google.com' in 'mfrom' identity (mechanism 'ip4:209.85.128.0/17' matched))
    identity=mailfrom;
    client-ip=209.85.219.70

From the point of view of email authentication, the message is perfectly legitimate, which is exactly what the attacker wants to slip past spam filters.

The link in the email points to share.google, Google’s official link-sharing service. Using a trusted Google domain as the first URL in the message is most likely a deliberate choice: many antispam and security products whitelist or skip the inspection of Google domains, so the link appears harmless. However, it redirects to a malicious URL that downloads a ZIP file:

GET hxxps://share[.]google/x24OvOSUMBR4LknhP

HTTP/1.1 302 Found
Location: hxxps://www[.]google[.]com/share[.]google?q=x24OvOSUMBR4LknhP
Cache-Control: private
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Mon, 19 Oct 2026 18:27:41 GMT
Server: sffe
Content-Length: 252
X-XSS-Protection: 0

GET hxxps://www[.]google[.]com/share[.]google?q=x24OvOSUMBR4LknhP

HTTP/2 301 
location: hxxps://get[.]passionit[.]co[.]nz/download[.]php/Condition_Assessment_Report_mp4?f=650ffa6e93c9204ad0f3f7dcee7d7d94&shem=aimgspe,
content-type: text/html; charset=UTF-8
date: Mon, 19 Oct 2026 18:21:31 GMT
expires: Wed, 18 Nov 2026 18:21:31 GMT
cache-control: public, max-age=2592000
server: gws
content-length: 322
x-xss-protection: 0

GET hxxps://get[.]passionit[.]co[.]nz/download[.]php/Condition_Assessment_Report_mp4

HTTP/3 200 
date: Mon, 19 Oct 2026 18:27:42 GMT
content-type: application/octet-stream
content-length: 150703490
server: cloudflare
content-disposition: attachment; filename="Condition_Assessment_Report_mp4.zip"
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: 0

File: Condition_Assessment_Report_mp4.zip
File size: 144 MB (150.703.490 bytes)
MD5: 38FD1502B9F0D3FCEC96B57D9279AF72
SHA1: D52CDEC492AC3AEEA1AE6D569ACFDAC99FF9CD86
SHA256: 841229F1B8FFF9E8404547A2C4D91BB8DA6C429476B1BB188DE4D519049C604E

The ZIP archive contains two files (an .exe and a hidden .dll) and a hidden “x” folder:

File: Condition_Assessment_Report_mp4.exe
File size: 1.25 MB
MD5: 122E2A7B947EB6185B12FF52966AB4BF
SHA1: 930983C4375824B80DB95BA8E64083D1564CA601
SHA256: C73E3B98B5F631669FB3D4B114E98AD55D2B015E2C55003C265E0B75E0C31D9E

File: krpt.dll
File size: 120 MB (126.149.120 bytes)
MD5: F1C0EF64C0A5FC2EF886371B7E5CEF6F
SHA1: 4B69B43D457B8311E064D8A2DCB2FBD182607240
SHA256: E2B4373C72FE60A95393D959EB9B6A76237963356BA5FA5261781CF3566CBB9F

This is where the attack gets clever. The executable is a legitimate WPS Office file, digitally signed by Zhuhai Kingsoft Office Software Co., Ltd. in May 2020. It has been renamed to Condition_Assessment_Report_mp4.exe so that it looks like the video recording mentioned in the email. When it is executed, it loads krpt.dll (the hidden malicious DLL file of 120 MB) from its own folder, a technique known as DLL side-loading. Because the malicious code runs inside a trusted, signed process, it is much more likely to evade detection.

The malicious DLL has a few interesting characteristics:

1. It is hidden, so the user only sees the executable when opening the extracted archive. The Hidden checkbox is grayed out in the file properties, which usually means the System attribute is also set on the file.
2. It is about 120 MB in size, probably an attempt to evade antivirus software that skips scanning very large files.

The hidden “x” folder contains various documents, which are likely used as decoys.

To summarize, the full infection chain looks like this:

Email sent via Google AppSheet (SPF, DKIM, DMARC pass)
  -> share.google link (trusted Google domain)
    -> Redirect to ZIP download (144 MB)
      -> Signed WPS Office executable disguised as a video
        -> Hidden 120 MB DLL loaded via DLL side-loading

OSArmor blocked the execution of the signed WPS Office executable as a suspicious process, preventing it from loading the hidden malicious DLL in the system:

This case shows that passing email authentication checks and using trusted links are no longer reliable signs that a message is safe. Every step of this attack relies on something legitimate: Google AppSheet to send the email, share.google to hide the malicious link, and a signed Kingsoft executable to load the malicious DLL. Be careful with unexpected emails that ask you to download files, even when they look like ordinary customer requests, and never run executable files that claim to be videos or documents!

Here are some indicators of compromise (IoC):

hxxps://share[.]google/x24OvOSUMBR4LknhP
hxxps://get[.]passionit[.]co[.]nz/download[.]php/Condition_Assessment_Report_mp4
get[.]passionit[.]co[.]nz
172.67.177.200
104.21.31.145
AS13335
Condition_Assessment_Report_mp4.zip
Condition_Assessment_Report_mp4.exe
krpt.dll
38FD1502B9F0D3FCEC96B57D9279AF72
D52CDEC492AC3AEEA1AE6D569ACFDAC99FF9CD86
841229F1B8FFF9E8404547A2C4D91BB8DA6C429476B1BB188DE4D519049C604E
F1C0EF64C0A5FC2EF886371B7E5CEF6F
4B69B43D457B8311E064D8A2DCB2FBD182607240
E2B4373C72FE60A95393D959EB9B6A76237963356BA5FA5261781CF3566CBB9F

---