Phishers Using Google Drive to Trick People into Visiting Malicious Websites

Reports emerged of phishers having abused a feature in Google Drive in an attempt to trick users into visiting malicious websites. In this scam wave, users reported having received Google Drive notifications in Russian or English asking them to collaborate on unfamiliar documents. Those documents contained links to scam websites. Some of those links tried to entice recipients into reviewing their bank account activity or accepting a cash prize. Others bombarded users with links advertising deals and/or prize selections. What made this wave of scams stand out is that fact that attackers generated the emails and notifications using Google Drive. Specifically, they used the Google service's collaboration feature to create a push notification and/or email inviting people to collaborate on a document containing a link that led to a malicious website. WIRED explained that phishers likely chose this tactic in order to get their attack emails into users' inboxes and past people's suspicions:

The success of email spam filters has left scammers looking for new ways to get people to click on malicious links. And Google Drive is pretty accommodating. By default, Drive wants you to know when someone has mentioned you on a document. In a work setting, this could be a colleague asking you to check over a slide in a presentation or a brief for a new project. For scammers, it’s a clever way of putting a malicious link right in front of a potential victim.

Some users indicated to WIRED that they had received several versions of the attack. Acknowledging this scam technique, a Google spokesperson told WIRED that Google was in the process of working on new security measures that would make it more difficult for Google Drive spam to avoid its systems. This scam wave highlights the need for users to be on the lookout for email-borne attacks. Organizations can help their users in this regard by educating them about some of the most common types of phishing attacks that are in circulation today.