This type of phishing campaign can sneak past traditional security defenses and careful scrutiny for a few key reasons.įirst, the email itself comes from a legitimate Google service, so it’s likely to evade detection and be trusted by users at first glance. So far, more than 500 inboxes have been targeted across 30 different organizations with the hackers using more than 100 different Gmail accounts. The full comment, however, includes a malicious link that will trigger a malware infection if activated through the sent email.ĭiscovered by Avanan in December 2021, the attacks have primarily hit Microsoft Outlook users but have also affected recipients on other email platforms. In this particularly devious campaign, the attackers add a comment to a Google document and then mention the target by typing the symbol followed by an email address. That action then triggers an email to the assigned person. When adding a comment to a document, you can include the email address of a person to whom you want to assign a related task. To help people collaborate on the same documents, Google Docs offers a comment feature. How to secure your email via encryption, password management and more (TechRepublic Premium)

In security, there is no average behavior

SEE: Social engineering: A cheat sheet for business professionals (free PDF) (TechRepublic) Must-read security coverageĨ5% of Android users are concerned about privacyĪlmost 2,000 data breaches reported for the first half of 2022 A new report released Thursday by email security provider Avanan looks at a new phishing campaign that abuses a popular feature in Google Docs to deploy malicious emails.

And the more popular the product, the greater the chances of success. One of the favorite tactics of cybercriminals is to exploit legitimate products for illegitimate purposes. Image: GrafVishenka, Getty Images/iStockPhotos Hackers exploit Google Docs in new phishing campaignĪttackers are taking advantage of the comment feature in Google Docs to send people emails with malicious links, says Avanan.

Google drive spam from my email