Hackers exploiting Google Docs, Outlook users at most risk

hackers are increasingly using Google Docs' productivity features to slip malicious links past spam filters and cyber security tools

Hackers exploiting Google Docs, Outlook users at most risk

Photo for representation. iStock

New Delhi, January 7

Hackers are sending malicious links through comments in Google apps like Docs and Slides primarily to Outlook users—a known vulnerability that has not been fully closed or mitigated by Google since last year, cyber-security researchers have warned.

According to US-based enterprise cybersecurity company Avanan, hackers are increasingly using Google Docs' productivity features to slip malicious links past spam filters and cyber security tools.

In June last year, Avanan reported on an exploit in Google Docs that allowed hackers to easily deliver malicious phishing websites to end-users. Now, hackers have found a new way to do the same thing.

"Starting in December 2021, Avanan observed a new, massive wave of hackers leveraging the comment feature in Google Docs, targeting primarily Outlook users," said researcher Jeremy Fuchs.

The comment feature across the Google suite has become an attack vector for hackers, he claimed in a report.

Avanan said it notified Google of this flaw on January 3, via the report phish through email button within Gmail.

Google was yet to react to the report.

In one such attack, hackers add a comment to a Google Doc. The comment mentions the target with an '@'. By doing so, an email is automatically sent to that person's inbox.

"In that email, which comes from Google, the full comment, including the bad links and text, is included. Further, the email address isn't shown, just the attackers' name, making this ripe for impersonators," said the report that came out on Thursday.

"In this email attack, hackers found a way to leverage Google Docs, and other Google collaboration tools, to send malicious links. We primarily saw it target Outlook users, though not exclusively. It hit over 500 inboxes across 30 tenants, with hackers using over 100 different Gmail accounts," it elaborated.

To guard against these attacks, before clicking on Google Docs comments, users should cross-reference the email address in the comment to ensure it's legitimate.

"Utilise standard cyber hygiene, including scrutinising links and inspecting grammar and deploy protection that secures the entire suite, including file-sharing and collaboration apps," said the researchers.

IANS

Tribune Shorts


Top Stories

SC upholds 27 pc OBC reservation in NEET all-India quota

Reservation not at odds with merit, says SC as it upholds 27 pc OBC quota in NEET

Top court says challenge to the validity of criteria for det...

Daughters to inherit fathers’ self acquired, inherited properties, to get preference over others: SC

Daughters to inherit fathers’ self acquired, inherited properties, to get preference over others: SC

Top court bench was dealing with the legal issue concerning ...

Covid deaths in third wave majorly lower than second due to high vaccine uptake

Covid deaths in third wave majorly lower than second due to high vaccine uptake

Bed occupancy in Delhi stable despite rise in new and active...

Masks not recommended for children aged 5 and under: New Covid guide on children

Masks not recommended for children aged 5 and under: New Covid guide on children

Issuing antimicrobial use guide, health ministry says Covid-...

Cities

View All