How spammers use Google services

[harlan4096]

As you know, Google is not just a search tool, but multiple services used by billions of people every day: Gmail, Calendar, Google Drive, Google Photos, Google Translate, the list goes on. And they are all integrated with each other. Calendar is linked to Gmail, Gmail to Google Drive, Google Drive to Google Photos, and so on.

It’s all very handy — register once and away you go. And there’s no need to mess around moving files and data between services; Google does everything for you. The downside is that online fraudsters have learned to exploit the convenience of Google services to send spam or worse.

Spam through Google services: Calendar, Photos, Drive, Storage, Analytics, and Forms

The spammer’s main task is to bypass the spam filter and deliver e-mail to your inbox. As it happens, Google services often send e-mail notifications to Gmail inboxes — and Google’s antispam module avoids flagging notifications from its own services as spam. With that in mind, let’s look at which Google services spammers use — and how.

Spam in Google Calendar

Naturally, if someone uses Google Calendar to arrange a meeting with you, you receive notifications about it. Well, spammers have recently taken to making appointments en masse.

Because Google Calendar is designed to let anyone at all invite you to a meeting, both Calendar and Gmail (which receives the notification) are totally fine with any John Doe scheduling a meeting with you.

Spammers use the location and topic fields to convey the details to you. Usually, their spam details consist of a short bit of text stating that you are entitled to a cash payment for some reason, and a link that supposedly lets you receive it.

After that, everything’s about the same — either it’s a phishing link from which the cybercriminals try to get your bank card details (ostensibly to send you the money), or they ask for some sort of transfer fee to be paid before the money is sent. (You’ll never see a dime, obviously.)

Attackers are also adept at using Google Calendar to set up fake polls for which a reward is likewise offered. And there is nothing to prevent them from using this same loophole to distribute other types of spam or phishing, as well as malware.

Continue Reading