Phishers Spoof Google Calendar Invites in Fast-Spreading, Global Campaign – Source: www.darkreading.com

Source: Anatolii Babii via Alamy Stock Photo

Attackers are spoofing Google Calendar invites in a fast-spreading phishing campaign that can bypass email protections and aims to steal credentials, ultimately to defraud users for financial gain.

The campaign, discovered by researchers at Check Point Software, relies on modified “sender” headings to make emails appear as if they were sent via Google Calendar on behalf of a legitimate entity, such as a trusted brand or individual, they revealed in a blog post published Dec. 17.

Initially, messages included malicious Google Calendar .ics files that would lead to a phishing attack, the threat hunters wrote. However, “after observing that security products could flag malicious Calendar invites,” attackers began aligning those files with links to Google Drawings and Google Forms to better disguise their activity.

Mass-Scale Financial Scamming Is the Goal

Given that Google Calendar is used by more than 500 million people and is available in 41 different languages, the campaign provides a massive attack surface, so “it is no wonder it has become a target for cybercriminals” seeking to compromise online accounts for financial gain, the team noted.

“After an individual unwittingly discloses sensitive data, the details are then applied to financial scams, where cybercriminals may engage in credit card fraud, unauthorized transactions or similar, illicit activities,” the researchers wrote in the post. Stolen data also can be used to bypass security measures on other victim accounts to lead to further compromise, they added.

Related:Interpol: Can We Drop the Term ‘Pig Butchering’?

Attackers also are moving fast with the campaign, with researchers observing more than 4,000 emails associated it in a four-week period. In those messages, attackers used references to about 300 brands in their fake invites to make them appear authentic, they wrote.

What a Google Calendar Phish Looks Like

A message associated with the campaign looks like a typical invite from Google Calendar in which someone known to or trusted by the individual targeted shares a calendar invite with them. The appearances of the messages vary, with some that really look almost identical to typical Google Calendar notifications, “while others use a custom format,” the team wrote.

As noted previously, the emails include a calendar link or file (.ics) that includes a link to Google Forms or Google Drawings in an attempt to bypass email-scanning tools. Once a user takes the bait, they are then asked to click on another link, “which is often disguised as a fake reCAPTCHA or support button,” that forwards them to a page “that looks like a cryptocurrency mining landing page or bitcoin support page,” according to the post.

Related:Wallarm Releases API Honeypot Report Highlighting API Attack Trends

“These pages are actually intended to perpetrate financial scams,” the team wrote. “Once users reach said page, they are asked to complete a fake authentication process, enter personal information, and eventually provide payment details.”

How to Avoid Becoming a “Google” Phishing Cyber Victim

Check Point contacted Google about the campaign, which recommended that Google Calendar users enable the “known senders” setting in the app to help defend against this type of phishing. This setting will alert a user when they receive an invitation from someone not in their contact list or someone with whom they have not interacted with from their email address in the past, the company said.

Corporate defenders can used advanced email security solutions that can identify and block phishing attacks that manipulate trusted platforms with the inclusion of attachment scanning, URL reputation checks, and AI-driven anomaly detection, the Check Point team wrote.

Organizations also should monitor the use of third-party Google Apps and use cybersecurity tools that can specifically detect and warn its security teams about suspicious activity on third-party apps.

Related:Texas Tech Fumbles Medical Data in Massive Breach

Finally, two often-cited pieces advice for organizations when recommending phishing defense — the use of multifactor authentication (MFA) across business accounts and employee training on sophisticated phishing tactics — also can work in cases like this to shore up security.

About the Author