Kaspersky Lab warns of a new phishing scheme in which attackers use the Google AppSheet platform to send emails with tempting job offers. To find out the details of the job, the potential victim is asked to click on the link in the letter and specify confidential information. Using a legitimate platform helps scammers to lull users to sleep and bypass traditional spam filters. Previously, the company has already recorded the spread of email threats using such legal services as Google Tasks, Google Sheets, and OpenAI.
What is the essence of the scheme. The attackers register on the Google AppSheet platform, after which they send fraudulent emails from a real service address, using plausible sender names in the display name. They simulate messages from the recruiting teams of large technology or FMCG companies, as well as automakers. The recipient is invited to meet and discuss career opportunities. To make an appointment, click on the link where the user needs to specify the name, contact information and preferred meeting time. After that, he is directed to another fraudulent page with a request for a username and password from accounts, for example, from Google. As a result of all these actions, a person risks compromising their confidential data.
Not just the link. Another fraudulent scenario is also possible: the email may not contain a phishing link, and the recipient will be asked to write a reply letter to the "recruiting team" on their own. Presumably, this is done in order to try to obtain the victim's credentials during further communication.
Why do phishing emails end up in the mailbox? Because emails are sent through Google's infrastructure, they often go through SPF, DKIM, and DMARC email protection technologies, which increases the likelihood of their successful delivery to potential victims. In addition, the AppSheet features allow you to send not only emails, but also SMS. To launch such campaigns, it is enough to subscribe to the service for a fee, even at the basic rate.
"Attackers are increasingly using legitimate cloud services in their attacks. We have already reported on fraudulent schemes using Google Forms and Google Tasks. Now the AppSheet is also used for large-scale phishing mailings. This method allows fraudsters to lull the vigilance of users, as well as make it difficult for security solutions to detect them. Therefore, it is important to carefully check any incoming messages, even if they come from trusted addresses," warns Anna Lazaricheva, senior spam analyst at Kaspersky Lab.
Please note that this press release is based on materials provided by the company. AK&M Information Agency shall not be held liable for its contents, nor for the legal and other consequences of its publication.
