Google App Scripts Become the Latest Way to Establish Credibility and Automate Phishing Attacks

Cybercriminals have found a new way of leveraging legitimate web services for malicious purposes, this time with the benefit of added automation of campaign actions.

Security researchers at CheckPoint have discovered a new phishing campaign that uses Google App Scripts – a scripting platform developed by Google that lets you integrate with and automate tasks across Google products – as the destination in malicious links.

According to CheckPoint, the campaign uses over 360 phishing emails purporting to be a payment service.  The emails are written in multiple languages that include English, Russian, Chinese, Arabic, Italian, German and French.

The links in the email subject and body point to script.google.com (the URL for Google App Scripts) increasing the legitimacy of links to security scanners.

Source: CheckPoint

The good news is the emails look to be poorly written – something an individual who has undergone continual new-school security awareness training will spot immediately. But for those that are none the wiser, this email (due to its misuse of the Google platform) may make it all the way to a user’s Inbox and carry out its’ malicious tasks if engaged with.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.

---

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

Here’s how it works:

• Immediately start your test for up to 100 users (no need to talk to anyone)
• Select from 20+ languages and customize the phishing test template based on your environment
• Choose the landing page your users see after they click
• Show users which red flags they missed, or a 404 page
• Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
• See how your organization compares to others in your industry

PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW