Attackers Find New Way to Exploit Google Docs for Phishing

Attackers Find New Way to Exploit Google Docs for Phishing

Researchers spotted what they describe as a new method that attackers appear to be using to lure victims to malicious phishing websites via Google Docs.

The attack chain begins with the threat actor sending potential victims an email—on a topic of likely interest or relevance to the victim—with a link to a document on Google Docs. Users who follow the link are directed to a Google Docs page with what appears to be a downloadable document, according to researchers at Avanan.


The page looks like a typical Google Docs page for sharing documents outside the organization. However, in reality it is a custom Web page that is designed to look like a Google Docs page, according to the researchers. When a user clicks on the link to download the document, they are redirected to a malicious phishing website that looks exactly like the sign-in page for Google Docs. Users who enter their username and password end up having their credentials stolen.


Gil Friedrich, CEO and Co-Founder of Avanan, says this is the first time his company has observed attackers abusing using Google Docs in this manner. "This is the first time—to our knowledge—that we have seen Google Docs used to render an entirely attacker-crafted Web page," Friedrich says.

The approach is very different than when an attacker might use a small company website to host malicious content. In those instances, an organization can simply block access to the site until the issue is resolved.


"You can't block Google," Friedrich says. "There's no way to establish a static layer, and even if you wanted to block that specific link for that specific file, within ten seconds, the hackers would move to a new file," because it costs th ..

Support the originator by clicking the read the rest link below.