Google Sheets C2 Beaconing Activity

Kaung Khant Ko@kaungkhantko

•updated Sep 8, 2026•1•0•4

Detects network requests to Google Sheets API containing specific markers (-tk- or val-) in the request body, indicative of potential command and control (C2) communication patterns often associated with malware payloads using Google Sheets for data exfiltration or command retrieval.