An ongoing phishing rip-off is abusing Google Calendar invitations and Google Drawings pages to steal credentials whereas bypassing spam filters.
In accordance with Examine Level, which has been monitoring the phishing assault, the menace actors have focused 300 manufacturers with over 4,000 emails despatched in 4 weeks.
Examine Level instructed BleepingComputer that the assaults focused a broad vary of firms, together with instructional establishments, healthcare providers, constructing firms, and banks.
The assault begins with the menace actors utilizing Google Calendar to ship assembly invitations that look fairly innocuous, particularly in the event you acknowledge a number of the different friends.
Embedded in these invitations, as proven beneath, is a hyperlink that results in Google Types or Google Drawings that immediate the person to click on one other hyperlink, sometimes disguised as a reCaptcha or help button.
Supply: Examine Level
E mail Researchers at Examine Level instructed BleepingComputer that by using the Google Calendar providers to provoke the phishing invitations, they bypass spam filters as they’re coming from a legit Google service.
“The attackers utilized Google Calendar providers, making the headers seem fully legit and indistinguishable from invites despatched by any typical Google Calendar person,” Examine Level instructed BleepingComputer.
The researchers shared a picture of the e-mail headers, exhibiting they handed DKIM, SPF, and DMARC e-mail safety checks, permitting the phishing invite to land within the targets’ inboxes.
Supply: Examine Level
To double the variety of phishing emails despatched to the goal, the menace actors may cancel the Google Calendar occasion and embody a message that might be despatched to attendees.
This message may embody a hyperlink, equivalent to a Google Drawings hyperlink, to additional drive targets to phishing pages.
Supply: Examine Level
Google Calendar phishing isn’t new, with Google beforehand rolling out protections permitting customers to dam a majority of these invitations extra simply.
Nevertheless, if a Google Workspace administrator doesn’t allow these protections, you’ll proceed to have invitations robotically added to your calendars.
Examine Level recommends that customers be cautious of all assembly invitations obtained, and in the event that they immediate you to click on on a hyperlink, ignore them except you belief or affirm the sender.
