When I clicked on the Google Sheet Addon on the GF website ( Google Sheets in Gravity Forms - Gravity Forms ) it took me to a page on the gravitymore.com website that contains a “Live Demo” link.
The page that this link goes to displays a Cloudflare Verification challenge and clicking the checkbox pastes a code snippet into the user clipboard and then displays verification steps to open a terminal window and type “ctrl + v”.
These scripts typically install an info-stealer (such as Lumma, Vidar, or Stealc). These tools silently collect saved browser passwords, autofill data, session cookies, Discord tokens, and cryptocurrency wallet extensions, sending them straight to the attacker.
Hi Donal,
Thank you for raising the alarm. And you were right to highlight the issue.
A compromised demo endpoint on our end was serving that fake Cloudflare prompt (the ClickFix clipboard attack). As soon as we caught this, we removed the compromised files, rotated all server access keys, and overhauled our hosting security.
The site and live demo link are clean, verified, and safe to use.
For anyone who clicked that checkbox and pasted the code into their terminal, please treat your system as compromised. Disconnect, run an offline malware scan, and change your saved passwords and session tokens immediately.
Appreciate you calling this out so quickly.
Hi Saad,
Happy to help.
It was a bit embarrassing as I was creating a demo to show your Google Sheet add-on to a client and I had to tell them that I’d try find an alternative solution because of the issue…
Regards,
Donal
Hi Donal,
We sincerely apologize for the inconvenience. We completely understand how frustrating this must have been, especially when you were preparing a demo for your client.
We’d be happy to look into this and help you get it resolved. Could you please share the version of the plugin you’re currently using? Also, could you let us know what issue you’re currently facing and, if possible, the steps to reproduce it?
Once we have these details, we can investigate the issue further and assist you accordingly.
Thanks for your patience and understanding.
Hi Saad,
As I mentioned in my earlier email, I didn’t get to buy your Google Sheet add-on because of the malware in your Cloudflare checkbox.
It’s hard to convince my client that your product is safe after your demo page nearly hijacked their laptop.
Best Regards,
Donal