New phishing method leveraging iCloud, PayPal, Google Docs

Avanan, a Check Point Software company, is warning of an evolution in phishing attacks that now leverage popular businesses and services to infiltrate people's inboxes. 

Named "Phishing Scams 3.0", this method involves attackers using actual legitimate services to execute their attack. In such scams, the victim receives an email from a totally legitimate service, such as PayPal or Google Docs, that includes a link to a malicious site. 

Cybercriminals have been impersonating PayPal, Google Docs, SharePoint, FedEx, Intuit, iCloud and more.

The hacker creates a free account in PayPal (for example), and finds email addresses to send to. The hacker creates a fake invoice that either says the user has been charged or something is about to renew, and the hacker clicks send.

In the past two months of February and March, Avanan researchers have seen a total of 33,817 email attacks, impersonating legitimate, popular firms and services.

"Business email compromise (BEC) attacks have evolved again. A traditional BEC attack relies upon the ability to look like someone with power within a company or a trusted external partner. Later on, attacks shifted to a method in which the attacker compromises an account, belonging to an organisation or one of his partner's organisation, and uses it to insert themselves into legitimate email threads, responding as if they were employees," says Jeremy Fuchs, spokesperson at Avanan. 

"Now, we're seeing something entirely new, where attackers are using actual legitimate services to carry their attack," he says. 

"In such scams, the victim receives an email from a totally legitimate service (e.g. PayPal, Google Docs), which will include a link to a malicious site. 

"In the past two months of February and March, our researchers have seen a total of 33,817 email attacks, impersonating legitimate, popular firms and services," says Fuchs.

"We call these new style of cyberattacks 'Phishing Scams 3.0', or BEC Firm Impersonation. It is important to note that there is nothing malicious with these popular sites, nor is there a vulnerability. Instead, hackers are using these services' legitimacy to gain entry into the inbox," he says. 

"I strongly urge folks to implement two-factor authentication and use email filters to protect themselves from these style of attacks." 

Cyber Safety Tips:

1. Use anti-phishing protections

2. Educate and train employees

3. Separate duties

4. Label external emails

In all examples recorded, the email address from which the email was sent looked perfectly legitimate and contained the "correct" addresses, which makes detection and identification much harder for the average user receiving them. Here, the hacker has added a comment in Google Sheets. All the hacker has to do is create a free Google account. Then, they can create a Google sheet, and mention the intended target. The recipient gets an email notification.

To the end-user, this is a fairly typical email, especially if they use Google Workspace. (And even if they don't, it's typical, as many organisations use Google Workspace and Microsoft 365).

Here is another example, this time using Google Docs.

This comes from a legitimate sender–Google. The URL, which is a script.google.com URL, is also legitimate upon the first scan. That is because that domain is legitimate. However, when you click on it, it gets redirected to a fake cryptocurrency site. These fake cryptocurrency sites work in a few ways. They can be straight phishing sites, where credentials will be stolen. Or there is a variety of other options, whether it is straight theft or crypto mining.