Hackers Exploit Google Calendar Notifications to Breach Corporate Email Security

Google Calendar is a scheduling and time-management tool designed to help individuals and businesses plan their days efficiently. Google Calendar is used by more than 500 million people worldwide and is available in 41 languages.

Its popularity and efficiency have also made Google Calendar a target for cybercriminals. Recently, security researchers at Check Point observed cybercriminals misusing Google tools, including Google Calendar and Google Drawings. Many emails appear legitimate because they seem to come directly from Google Calendar. Attackers manipulate the sender headers to make messages appear to have been sent through Google Calendar on behalf of a known, legitimate person. So far, around 300 brands have been affected by this campaign, with more than 4,000 phishing emails detected over four weeks.

Initially, these phishing attacks exploited Google Calendar's user-friendly features by including links to Google Forms. However, after cybersecurity systems started flagging malicious Calendar invitations, the criminals adapted the attack to exploit Google Drawings features.

The initial emails contain a link or a calendar file (.ics) with a link to Google Forms or Google Drawings. Users are then prompted to click another link, often disguised as a fake reCAPTCHA or support button. Clicking redirects them to a page resembling a cryptocurrency or Bitcoin support platform.
These pages are designed to perpetrate financial scams. Once there, users are asked to complete a bogus authentication process, enter personal information and, finally, provide payment details.

How to Block This Attack

Organisations wishing to protect their users from phishing threats of this kind should consider the following practical measures:

• Advanced email security solutions
  Tools such as LeonardoNetwork Email Defender can detect and block sophisticated phishing attempts, even when they exploit trusted platforms such as Google Calendar and Google Drawings. High-quality security solutions include attachment scanning, URL reputation checks and AI-based anomaly detection.
• Monitoring third-party apps integrated with Google
  Use cybersecurity tools capable of detecting and reporting suspicious activity in third-party applications linked to business accounts.
• Implementing strong authentication mechanisms
  One of the most important measures is to enable multi-factor authentication (MFA) on all business accounts. In addition, implement behavioural analysis tools to detect unusual login attempts or suspicious activity, including visits to cryptocurrency-related sites.

Individuals concerned that these scams may reach their personal inboxes should take the following precautions:

• Be wary of suspicious event invitations
  Does an invitation contain unexpected information or require unusual steps (such as completing a CAPTCHA)? If so, do not interact with it.
• Examine incoming content carefully
  Think before you click. Hover over links to inspect their destinations and enter website addresses manually in your browser for safer access.
• Enable two-factor authentication
  Enable two-factor authentication (2FA) on Google accounts and other platforms containing sensitive information. Even if credentials are compromised, 2FA can prevent criminals from gaining access to the account.

In response to the issue, Google stated:

“We recommend that users enable the ‘Known senders’ setting in Google Calendar. This option helps protect against this type of phishing by warning users when they receive an invitation from someone who is not in their contacts or with whom they have not previously interacted by email.”

Source: Check Point Team and Forbes