Hackers are Using Google Docs (and other Cloud Services) to Attack Users

There are many ways that hackers have attempted to subvert the advanced security precautions implemented by enterprises and small businesses alike, but some of the more recent and crafty ones include sending threats through seemingly legitimate sources, like social media. The latest in this string of attacks includes Google Docs, and it is problematic for a number of reasons.

Essentially, what happens is that the hacker places a malicious link in a Google Docs comment and uses the @ symbol to directly ping the target through a targeted email. Since the email comes directly from Google Docs, users may not have any reason to suspect that it could be malicious in nature. This particular strategy was observed by Avanan, which reported it on their blog. The attacks themselves are carried out using Google Docs and Google Slides, and are often leveraged against users of Microsoft Outlook.

These attacks are generally quite successful because of how easily they can bypass spam filters. Since Google is a well-known and trusted entity, it is on most Allow Lists, meaning that their messages will get through to your inbox in most cases. Furthermore, since the attack itself is carried out using the comments, only the attacker’s name is showcased, not their email address. This opens up tons of possibilities for hackers to fool users into thinking someone within their organization is sharing a document with them, even when it is just a hacker attempting to cause trouble.

In short, the moral of the story here is that you should never click on links that look or seem suspicious by any stretch of the imagination–--especially if they appear to be from a service that your business doesn’t utilize, like Google Workspace. If it does use Google Workspace, still treat it with caution and follow up with whoever the user is to ensure its authenticity. It never hurts to clarify the sender of a link, and it sure beats downloading some random threat that could leave your business in shambles. You can also double-check the destination for a link by hovering over it to ensure that it is sending you to the correct location, or at least the one that you expect it to. 

For updates on the latest threats, be sure to subscribe to BNMC’s blog