However, more crafty spear-phishers might make their address (if available) and leave their notifications on, tricking some less savvy users into clicking on the document coming from a familiar name without thinking twice about it being sent from a generic domain rather than an official company domain. Below you can see an obviously fake email attached to the notification, that would be obvious to any user that it is fake, regardless of it being sent from a generic Gmail account. The reason for this step is if they notify their target via email, the “from” address in the notification message may tip them off to the ruse. When sharing these fake documents, the first step the imposter takes will usually be unchecking the box that sends an email notification. Kettle to ask an unsuspecting Varonis employee to sign into their employee account to help him with an important project. Let’s go on a Phishing tripįor the purpose of this spear phishing with Google Drive walkthrough, we will be posing as (fake) Varonis executive Mike T. According to Wired, there have been instances of a single document from a Russian source being copied and edited multiple times in an attempt to lure new victims with each iteration. These attacks are targeting individuals and enterprises alike. As a result, the victim’s mail provider has a much harder time differentiating these emails from legitimate ones sent by trusted sources. But instead of using a low reputation sending domain that’ll trigger SPAM filters, they’re using Google’s own infrastructure. Much like typical spear-phishing campaigns, Google Drive attackers will create a fake email address to impersonate an individual or department that the target will recognize. These email notifications include a note and a link asking the victim to click the included link to sign in to their Google account to collaborate on a project or fill out official HR forms.

However, crafty scammers are now spear phishing with Google Drive’s sharing features to send emails with links to infected documents to their targets. Improved email security has forced hackers to get creative when it comes to getting their malicious links to hit the inbox. These scams are so common that all of the major email providers have built-in anti-phishing features.

Phishing scams are as old as the internet-tricking victims into divulging important information about themselves and their accounts.

Google drive spam notifications