Refined Phishing Scam Exploits Google Calendar to Bypass Security
A sophisticated phishing campaign is making headlines,utilizing Google Calendar invites and Google Drawings pages to steal user credentials while cleverly evading spam filters. Security researchers at Check Point have been tracking this widespread attack, revealing a concerning trend in online security.
According to Check Point,the threat actors have targeted over 300 brands,sending more than 4,000 emails in just four weeks. The targeted organizations represent a diverse range of industries,including educational institutions,healthcare providers,construction firms,and even financial institutions.
The attack begins with seemingly innocuous Google Calendar meeting invites. The invites often include familiar names among the attendees, making them appear legitimate and less suspicious. Though, lurking within these invites is a malicious link.
This link leads to a Google Forms or Google Drawings page, which then prompts the user to click another link, often disguised as a reCAPTCHA or a support button. This multi-step process is designed to further mask the malicious intent.
“The attackers utilized Google Calendar services, making the headers appear fully legitimate and indistinguishable from invitations sent by any typical Google calendar user,” Check Point explained in a statement. This clever tactic allows the phishing emails to bypass many spam filters.
To amplify the impact, the attackers frequently enough cancel the Google Calendar event and send a cancellation notification to all attendees. This notification also contains a malicious link, frequently leading to a Google Drawings page, further increasing the chances of prosperous phishing.
While Google has previously introduced protections to help users block these types of invites, these measures are only effective if enabled by Google Workspace administrators. Without proper configuration, users remain vulnerable.
Check Point strongly advises users to exercise caution with all received meeting invites. Never click on links within invites unless you have independently verified the sender’s identity and the legitimacy of the request. This proactive approach is crucial in protecting yourself from these sophisticated phishing attacks.
