Hackers are currently exploiting the Google Docs platform, using it as a platform to host phishing attacks aimed at others via sending data siphoning links.
The threat was uncovered by the analysts and researchers of Avanan, a cybersecurity firm. The entire attack and its discovery is broken down by Jeremy Fuchs. The post, published on Avanan's blog, highlights how Google Docs is being utilized as a tool for spearheading phishing attacks against other members of the community.
Users are sent an email, with a link enclosed within. These links can be sent under the guise of the subject matter being a downloadable document available from Google Docs, with the email urging users to download and read at their leisure. To make matters worse, upon clicking the link, the ensuing website matches Google Docs, further adding a tinge of fabricated legitimacy to the hacker's phishing attempts. The URL's landing page asks users to download the "document". Upon attempting to do so, users are then further redirected to a look-alike of Google's Login portal. There, individuals can add their respective credentials, exposing personal data in the attempt.
While it's difficult for the more tech-savvy crowd to fall for such attacks, especially since bots are easily distinguished by their wooden, non-human dialogue, the duplicating of Google Docs and the Login portal spell an entirely different ballgame. More gullible users, or those unaware of the online space can very easily fall victim to the attack. The legitimacy of the fabricated webpages is further bolstered by the fact that it is Google Docs itself that generates them. All the hackers have to do is write HTML resembling Google Docs, and upload it to the Google Drive. Upon being uploaded to the Drive, Google renders the HTML code into a Docs preview webpage all on it's own.
From there on, the hackers open the HTML code in Google Docs itself. Here's where things get a bit more technical. Upon using the Embed and Publish on Web features already present in Google Docs, to more or less generate the URL that'll be utilized and sent forward by hackers to unsuspecting users, in the attempts of
Read next: A security researcher catches a dangerous bug in Facebook Messenger Room that could steal users private data
The threat was uncovered by the analysts and researchers of Avanan, a cybersecurity firm. The entire attack and its discovery is broken down by Jeremy Fuchs. The post, published on Avanan's blog, highlights how Google Docs is being utilized as a tool for spearheading phishing attacks against other members of the community.
Users are sent an email, with a link enclosed within. These links can be sent under the guise of the subject matter being a downloadable document available from Google Docs, with the email urging users to download and read at their leisure. To make matters worse, upon clicking the link, the ensuing website matches Google Docs, further adding a tinge of fabricated legitimacy to the hacker's phishing attempts. The URL's landing page asks users to download the "document". Upon attempting to do so, users are then further redirected to a look-alike of Google's Login portal. There, individuals can add their respective credentials, exposing personal data in the attempt.
While it's difficult for the more tech-savvy crowd to fall for such attacks, especially since bots are easily distinguished by their wooden, non-human dialogue, the duplicating of Google Docs and the Login portal spell an entirely different ballgame. More gullible users, or those unaware of the online space can very easily fall victim to the attack. The legitimacy of the fabricated webpages is further bolstered by the fact that it is Google Docs itself that generates them. All the hackers have to do is write HTML resembling Google Docs, and upload it to the Google Drive. Upon being uploaded to the Drive, Google renders the HTML code into a Docs preview webpage all on it's own.
From there on, the hackers open the HTML code in Google Docs itself. Here's where things get a bit more technical. Upon using the Embed and Publish on Web features already present in Google Docs, to more or less generate the URL that'll be utilized and sent forward by hackers to unsuspecting users, in the attempts of
Read next: A security researcher catches a dangerous bug in Facebook Messenger Room that could steal users private data
