Google App Scripts Become the Latest Way to Establish Credibility and Automate Phishing Attacks

Cybercriminals have found a new way of leveraging legitimate web services for malicious purposes, this time with the benefit of added automation of campaign actions.

Security researchers at CheckPoint have discovered a new phishing campaign that uses Google App Scripts – a scripting platform developed by Google that lets you integrate with and automate tasks across Google products – as the destination in malicious links.

According to CheckPoint, the campaign uses over 360 phishing emails purporting to be a payment service.  The emails are written in multiple languages that include English, Russian, Chinese, Arabic, Italian, German and French.

The links in the email subject and body point to script.google.com (the URL for Google App Scripts) increasing the legitimacy of links to security scanners.

Source: CheckPoint

The good news is the emails look to be poorly written – something an individual who has undergone continual new-school security awareness training will spot immediately. But for those that are none the wiser, this email (due to its misuse of the Google platform) may make it all the way to a user’s Inbox and carry out its’ malicious tasks if engaged with.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.