Hackers are abusing Google Docs to bypass security protections

Google Docs make collaborating in real-time with colleagues a seamless experience but hackers have found ways to leverage these capabilities to send malicious links to unsuspecting users.

Back in June of last year, researchers at Check Point-owned Avanan discovered an exploit in the search giant’s office software that allowed an attacker to easily deliver links to phishing sites to end-users. Now though, hackers have discovered a new way to do the exact same thing.

It was reported in October that hackers could use comments in Google Workspace apps like Docs and Slides to easily send malicious links to other users. Although this is a known vulnerability, Google has yet to fully close or mitigate it in the time since.

Beginning in December of 2021, Avanan’s researchers observed a new campaign in which a massive wave of hackers leveraged the comment feature in Google Docs to primarily target users of Microsoft’s email service Outlook.

Using comments to target Workspace users

According to a new blog post from Avanan, in this attack, hackers are adding comments with malicious links to Google Docs using @ mentions. 

Unlike with typical malicious campaigns that rely on emails sent from an attacker to reach potential victims, in this case Google automatically sends an email to a targeted user. In these emails, the full comment along with the malicious link and text are sent though the email address of the sender isn’t shown, just the attacker’s name which makes it easy to impersonate someone at their organization.

Although the campaign primarily targeted Microsoft Outlook users, they weren’t the only people affected and Avanan observed over 500 inboxes across 30 tenants affected with the attackers responsible using over 100 different Gmail accounts. The cybersecurity firm notified Google of this flaw at the beginning of this month using the report phish through email button within Gmail.

To prevent falling victim to this attack and others like it, end users should remain as vigilant when checking and responding to comments in Google Docs, Sheets and Slides as they do when checking their inbox for malicious emails.

We’ve also featured the best antivirus, best malware removal software and best endpoint protection software