BACKGROUND:
Avanan analysts have recently discovered an exploit vector in Google Docs that attackers are using to deliver malicious phishing websites to victims. The Google Docs page may look familiar to those who share Google Docs outside of their organization. This, however, isn’t that page. It’s a custom HTML page made to look like that familiar Google Docs share page. The attacker wants the victim to “Click here to download the document” and once the victim clicks on that link, they will be redirected to the actual malicious phishing website where their credentials will be stolen through another webpage made to look like the Google Login portal. But, that is not Google’s website.
<p>This phishing campaign could be delivered to any user regardless of what type of device they’re on. Campaigns with that type of flexibility oftentimes have a greater chance of success, especially if they hit a target on a mobile device where it’s harder to spot phishing attacks. This incident shows how simple it is to build a convincing phishing page. You don’t have to be an experienced software engineer to carry this out. Combining this tactic with social engineering could create a very convincing campaign where the attacker is able to swipe personal or corporate login credentials. </p> <p> </p> <p>Threat actors know that stealing legitimate login credentials is the best way to discreetly enter an organization’s infrastructure. Since most organizations use either Google Workspace or Microsoft 365 as their main productivity platform, attackers build phishing campaigns that specifically exploit those services. Once the attacker has those login credentials and can log into the cloud platform they’ve chosen to build their campaign around, there’s no limit to what data they could exfiltrate. </p> <p> </p> <p>The popularity of these platforms means that data is constantly moving between unmanaged devices and the platform itself. IT and Security teams need to implement an endpoint-to-cloud security strategy based on Zero Trust in order to keep up with today’s modern threat landscape. Assuming that no device or user can be trusted until proven otherwise can prevent attacks before they even begin. Teams also need to have insight into the context behind users and devices when they attempt to log into corporate infrastructure. Usually, when credentials are compromised, the first giveaway is that the user logs in from a location very far away from where the employee is located. Understanding user behavior in such a way that access could be blocked on account of an anomalous login location is an incredibly important part of keeping modern infrastructure secure.</p>