3 Recent Attacks Where Phishers Abused Google鈥檚 Services
In a recent blog post, I discussed seven instances in which digital attackers abused Microsoft to launch phishing campaigns in recent years. The reality is that Microsoft is just one of the many companies targeted by phishers. Email attackers misuse the services of others, too.
Take Google as an Example
Attackers have a history of abusing Google鈥檚 services. Back in May 2020, for instance, detected multiple phishing attempts abusing Google Firebase, a mobile and web application development platform which provides secure uploads and downloads for supported apps. Some of those attack attempts used the pandemic and Internet banking as lures to trick victims into clicking on a fake vendor payment form that redirected them to a phishing page hosted on Firebase Storage. Others used an Office 365 phishing lure to redirect victims to an Office 365 phishing page hosted on Firebase.
Several months after that, reported on a campaign in which digital attackers used Google Forms to create phishing landing pages masquerading as the login pages for more than 25 different entities. Security researchers detected a total of more than 250 different pages created using Google Forms as part of the campaign. More than 70% of those fake login pages impersonated AT&T, while the others claimed to belong to various financial organizations, collaboration apps, and government agencies.
It was about a month later when 秋葵视频色 | AppRiver detected an email that came from someone named 鈥淒iana.鈥 Using the subject line 鈥淩e-validation,鈥 the message claimed to be official correspondence from Microsoft Exchange requiring recipients to upgrade to the 鈥渓atest e-mail Outlook Web Apps 2020.鈥 The email contained an 鈥淯PGRADE鈥 link that, when clicked, redirected victims to a file hosted via Google Docs and disguised as an OWA login portal.
Google鈥檚 Upcoming 2SV Auto-Enroll Drive
In response to the attacks discussed above, among others, Google is taking steps to protect its users. One of its most recent initiatives involves an effort to auto-enroll 150 million users accounts into its two-step verification (2SV) feature. As part of that drive, the tech giant announced its intention to require two million YouTube creators to turn on the feature, as well.
鈥淲e also recognize that today鈥檚 2SV options aren鈥檛 suitable for everyone, so we are working on technologies that provide a convenient, secure authentication experience and reduce the reliance on passwords in the long-term,鈥 Google explained in a . 鈥淩ight now we are auto-enrolling Google accounts that have the proper backup mechanisms in place to make a seamless transition to 2SV. To make sure your account has the right settings in place, take our quick .鈥
How to Defend Against Email Attacks Abusing Google
Organizations can take several steps to defend themselves against email attacks abusing the services of Google and other tech providers. First, they can use security awareness training to educate their users about new email attacks. They can also highlight the point that Google intends to 鈥渁uto-enroll鈥 users into its 2SV feature, which means they won鈥檛 have to do anything on their end. As such, organizations can educate employees to be wary of emails that disguise themselves as Google informing recipients that they need to activate 2FA on their accounts.
That鈥檚 not all organizations can do. They can also emphasize the importance of users logging into their web accounts by visiting a website directly, suggest that employees proactively enroll in 2FA schemes on whichever accounts they can, and avoid clicking on links embedded in emails. Finally, they can use a security solution to scan incoming emails on multiple layers.