Attackers Exploit Flaw in Google Docs’ Comments Feature

[silversurfer]

Content source

https://threatpost.com/attackers-exploit-flaw-google-docs-comments/177412/

Attackers are using the “Comments” feature of Google Docs to send malicious links in a phishing campaign targeted primarily at Outlook users, researchers have discovered.

Researchers from email collaboration and security firm Avanan, a CheckPoint company, first observed “a new, massive wave of hackers leveraging the comment feature in Google Docs” in December, Avanan Cybersecurity Researcher/Analyst Jeremy Fuchs wrote in a report published Thursday.

Avanan first identified that the Comments feature of Google Docs, Sheets and Slides could be exploited to send spam emails in October, but so far Google has not responded to the issue, Fuchs wrote.
“This known vulnerability has not been fully closed or mitigated by Google since then,” he wrote in the report.

So far, attackers have hit more than 500 inboxes across 30 tenants from more than 100 different Gmail accounts by exploiting the feature of Google’s cloud-based word processing app, according to the report.

Attackers Exploit Flaw in Google Docs’ Comments Feature

A wave of phishing attacks identified in December targeting mainly Outlook users are difficult for both email scanners and victims to flag, researchers said.

threatpost.com