Novel Phishing Attack Abuses Google Drive and Docs

Enterprising cyber-criminals have identified a way to build convincing phishing e-mails which abuse Google Docs and Push features to bypass security filters, in accordance to Avanan.

Scientists at the email security vendor claimed this is the to start with time this sort of procedures have been utilised to piggyback on a preferred provider like Google’s.

The email that victims obtain consists of what appears to be a reputable Google Docs backlink, Avanan defined in a blog publish.

Clicking by means of takes the consumer to a Google Docs website page hosting what appears to be a Term doc.

“This Google Docs site may appear familiar to all those who share Google Docs exterior of their business. This, nevertheless, isn’t that web page. It is a custom HTML web site designed to look like that familiar Google Docs share website page,” Avanan explained.

“The attacker desires the target to ‘Click in this article to download the document’ and after the target clicks on that backlink, they will be redirected to the true malicious phishing website the place their credentials will be stolen by a further web web site designed to appear like the Google Login portal.”

The attack alone is fairly straightforward to execute. A destructive coder generates an HTML web page developed to resemble a Google Docs sharing page and uploads it to Google Travel.

Then they only ideal-click on to open in Google Docs, prior to embedding and publishing it to the web. Google does most of the really hard work, such as building a hyperlink that will render the complete HTML file, Avanan spelled out.

The vendor claimed a equivalent strategy had been utilized to spoof a DocuSign document, using the person to a phony DocuSign login site.

Making use of Google Docs in this way, attackers have a great prospect of bypassing static backlink scanners that lots of legacy security merchandise use, Avanan argued. An AI-based software able of spotting suspicious conduct should really accomplish greater.

Phishing continues to be the best threat vector for today’s cyber-criminals. Of the 62.6 billion cyber-threats detected by Craze Micro previous year, over 91% were being sent by way of email.

Hank Schless, senior supervisor of security solutions at Lookout, argued that phishing attacks like these could significantly influence company cybersecurity.

“Threat actors know that stealing respectable login credentials is the best way to discreetly enter an organization’s infrastructure. Considering the fact that most businesses use both Google Workspace or Microsoft 365 as their key efficiency system, attackers develop phishing strategies that precisely exploit those products and services,” he included.

“Once the attacker has these login qualifications and can log into the cloud platform they’ve picked to develop their marketing campaign all over, there’s no limit to what information they could exfiltrate.”

Some sections of this report are sourced from:
www.infosecurity-journal.com