There are a number of reasons it’s hard for victims to recognize that the email sent to them after being tagged in Comments is malicious, Fuchs noted. That email, which comes from Google, includes text as well as the malicious links, Fuchs said.Īn example using the same method to exploit Google Slides, the suite’s presentation app, is included in the report. So far, attackers have hit more than 500 inboxes across 30 tenants from more than 100 different Gmail accounts by exploiting the feature of Google’s cloud-based word processing app, according to the report.Īttackers target users of Google Docs by adding a comment to a document that mentions the targeted user with an which automatically sends an email to that person’s inbox.
“This known vulnerability has not been fully closed or mitigated by Google since then,” he wrote in the report. Researchers from email collaboration and security firm Avanan, a CheckPoint company, first observed “a new, massive wave of hackers leveraging the comment feature in Google Docs” in December, Avanan Cybersecurity Researcher/Analyst Jeremy Fuchs wrote in a report published Thursday.Īvanan first identified that the Comments feature of Google Docs, Sheets and Slides could be exploited to send spam emails in October, but so far Google has not responded to the issue, Fuchs wrote. Attackers are using the “Comments” feature of Google Docs to send malicious links in a phishing campaign targeted primarily at Outlook users, researchers have discovered.
0 kommentar(er)
