Threat actors are leveraging the comment feature in Google Docs and other Google collaboration tools to send malicious content, primarily to Outlook users.
According to new research from cybersecurity firm Avanan, hackers have found a way to use these useful collaboration tools from Google to target Outlook users, hitting over 500 inboxes across 30 tenants, with hackers using over 100 different Gmail accounts.
The attack method makes it difficult for scanners to stop, and for end users to spot, Avanan says.
“For one, the notification comes directly from Google. Google is on most ‘Allow Lists’ and is trusted by users,” the company says in a blog. “Secondly, the email doesn’t contain the attacker’s email address, just the display name. This makes it harder for anti-spam filters to judge, and even harder for the end-user to recognize.”
Threat actors can create a free Gmail account (such as [email protected]), create a Google Doc, insert a comment and send it to their intended target. The end user won’t know whether the comment came from an email address like [email protected] or [email protected].
The email will just say “Bad Actor” mentioned the recipient in a comment in the document. If the Bad Actor is a colleague, it will appear trusted. The email will also contain the full comment, along with links and text. The victim never has to go on the actual document because the payload is in the email itself.
The attacker doesn’t even have to share the document—simply mentioning the person in the comment is enough, Avanan says.
The company recommends IT and security professionals take these steps to protect against these attacks:
- Encourage end users to cross reference the email address in the comment to ensure it’s legitimate before clicking on the Google Docs comment.
- Preach standard cyber hygiene, including double checking links, domains and grammar in emails.
- Reach out to the legitimate sender and confirm they meant to send the document
- Deploy software that secures file-sharing and collaboration apps
Avanan’s research comes months after other reports of similar Google Docs exploits.
Leave a Reply