Hackers are abusing Google Docs to send malicious links, and Google hasn't fixed the vulnerability yet

Advertisement
Hackers are abusing Google Docs to send malicious links, and Google hasn't fixed the vulnerability yet
Hackers are abusing Google DocsGoogle
Hackers are sending malicious links through comments in Google apps like Docs and Slides primarily to Outlook users -- a known vulnerability that has not been fully closed or mitigated by Google since last year, cyber-security researchers have warned.
Advertisement

According to US-based enterprise cybersecurity company Avanan, hackers are increasingly using Google Docs' productivity features to slip malicious links past spam filters and cyber security tools.

In June last year, Avanan reported on an exploit in Google Docs that allowed hackers to easily deliver malicious phishing websites to end-users. Now, hackers have found a new way to do the same thing.

Complimentary Tech Event
Transform talent with learning that works
Capability development is critical for businesses who want to push the envelope of innovation.Discover how business leaders are strategizing around building talent capabilities and empowering employee transformation.Know More
"Starting in December 2021, Avanan observed a new, massive wave of hackers leveraging the comment feature in Google Docs, targeting primarily Outlook users," said researcher Jeremy Fuchs.

The comment feature across the Google suite has become an attack vector for hackers, he claimed in a report.

Advertisement

Avanan said it notified Google of this flaw on January 3, via the report phish through email button within Gmail.

Google was yet to react to the report.

In one such attack, hackers add a comment to a Google Doc. The comment mentions the target with an '@'. By doing so, an email is automatically sent to that person's inbox.

"In that email, which comes from Google, the full comment, including the bad links and text, is included. Further, the email address isn't shown, just the attackers' name, making this ripe for impersonators," said the report that came out on Thursday.

"In this email attack, hackers found a way to leverage Google Docs, and other Google collaboration tools, to send malicious links. We primarily saw it target Outlook users, though not exclusively. It hit over 500 inboxes across 30 tenants, with hackers using over 100 different Gmail accounts," it elaborated.

Advertisement
To guard against these attacks, before clicking on Google Docs comments, users should cross-reference the email address in the comment to ensure it's legitimate.

"Utilise standard cyber hygiene, including scrutinising links and inspecting grammar and deploy protection that secures the entire suite, including file-sharing and collaboration apps," said the researchers.

SEE ALSO:

Instagram to offer more customisation to home feed with these options

Twitter is now letting users retweet with videos and photos — here’s how it works

Advertisement
India’s ePassport — What it is and how to apply
{{}}