These attacks are targeting individuals and enterprises alike. As a result, the victim’s mail provider has a much harder time differentiating these emails from legitimate ones sent by trusted sources. But instead of using a low reputation sending domain that’ll trigger SPAM filters, they’re using Google’s own infrastructure. Much like typical spear-phishing campaigns, Google Drive attackers will create a fake email address to impersonate an individual or department that the target will recognize. These email notifications include a note and a link asking the victim to click the included link to sign in to their Google account to collaborate on a project or fill out official HR forms. However, crafty scammers are now spear phishing with Google Drive’s sharing features to send emails with links to infected documents to their targets. Improved email security has forced hackers to get creative when it comes to getting their malicious links to hit the inbox. These scams are so common that all of the major email providers have built-in anti-phishing features. Phishing scams are as old as the internet-tricking victims into divulging important information about themselves and their accounts.

Google drive for desktop scam