Avanan analysts have recently discovered an exploit vector in Google Docs that attackers are using to deliver malicious phishing websites to victims.

The attacker wants the victim to “Click here to download the document” and once the victim clicks on that link, they will be redirected to the actual malicious phishing website where their credentials will be stolen through another webpage made to look like the Google Login portal.

This attack is actually quite simple to execute mainly because Google does most of the work for the attackers. 

Hank Schless, Senior Manager, Security Solutions at Lookout, says, "This phishing campaign could be delivered to any user regardless of what type of device they’re on. Campaigns with that type of flexibility oftentimes have a greater chance of success, especially if they hit a target on a mobile device where it’s harder to spot phishing attacks. This incident shows how simple it is to build a convincing phishing page. You don’t have to be an experienced software engineer to carry this out.  Combining this tactic with social engineering could create a very convincing campaign where the attacker is able to swipe personal or corporate login credentials." 

"Threat actors know that stealing legitimate login credentials is the best way to discreetly enter an organization’s infrastructure. Since most organizations use either Google Workspace or Microsoft 365 as their main productivity platform, attackers build phishing campaigns that specifically exploit those services. Once the attacker has those login credentials and can log into the cloud platform they’ve chosen to build their campaign around, there’s no limit to what data they could exfiltrate," Sch;ess says. "The popularity of these platforms means that data is constantly moving between unmanaged devices and the platform itself. IT and security teams need to implement an endpoint-to-cloud security strategy based on Zero Trust in order to keep up with today’s modern threat landscape. Assuming that no device or user can be trusted until proven otherwise can prevent attacks before they even begin."

Schless adds, "Teams also need to have insight into the context behind users and devices when they attempt to log into corporate infrastructure. Usually, when credentials are compromised, the first giveaway is that the user logs in from a location very far away from where the employee is located. Understanding user behavior in such a way that access could be blocked on account of an anomalous login location is an incredibly important part of keeping modern infrastructure secure."

Hackers are bypassing static link scanners by hosting their attacks in publicly known services, say Avanan researchers, who have seen this in the past with small services like MailGun, FlipSnack, and Movable Ink but this is the first time they're seeing it through a major service like Google Drive/Docs. 

Joseph Carson, chief security scientist and Advisory CISO at ThycoticCentrify, explains, "One of the biggest mistakes security professionals can make is to assume that other personnel and staff have the same understanding for good cyber hygiene as they do. Frankly, the average worker isn’t trained in cyber hygiene and best practices, making them easy prey for cybercriminals looking to access an organization's networks quickly and easily via a phishing attack or clever social engineering. By ensuring that employees at every level are given sufficient training about how to identify malware-laced emails and other rudimentary attempts at credential theft can be a major step to help reduce the success rate of an attack or at least raise an alert. And by normalizing training within the culture of the workplace, organizations can help maintain vigilance for these practices long term.

Timur Kovalev, chief technology officer at Untangle, says, "While an employee’s intentions may be good, clicking on a phishing link can open the door to hackers. For a small business in particular, the effects of an attack can be devastating, and in the worst cases lead to the business shutting down. Encouraging small businesses to act, and step up their cyber security technology, is a good thing. Not all small businesses are aware of the risks, and those that do know the risks don’t always have enough budget to invest in enough protection.