Scammers are abusing Google Calendar services to trick victims into giving away the personal and financial information such as passwords, card details, or account IDs.
Calendar phishing is highly effective as it comes from trusted, legitimate services; it can even trick users who might not fall in other forms of attacks.
Kaspersky observed several unsolicited pop-up calendar notifications appearing for Gmail users as a result of sophisticated spam emails sent by scammers.
The emails aimed in exploiting “default feature for people using Gmail on their smartphone: the automatic addition and notification of calendar invitations,” states Kaspersky press release.
The attackers use to send an unsolicited calendar invitation that contains a phishing link, in the victims phone it pop-up notification in the smartphone and stir victim’s to click on the link.
Once the user click’s on the links, they are getting redirected to “website that featured a simple questionnaire and offered prize money upon completion.” To get the price, victims are asked to provide the card details and other personal information.
Instead of delivering the prize, the entered details are sent to the attacker’s server, who can use the information to steal money and to launch various attacks.
“The ‘calendar scam’ is a very useful scheme, as most people have become used to receiving spam messages from emails or messenger apps,” said Maria Vergelis, a security researcher at Kaspersky. “But this may not be the case when it comes to the Calendar app, which has the main purpose to organize information rather than transfer it.
Mitigations
To avoid the issue, researchers suggested to Turn off the automatic adding of invitations to your calendar.
You need to check the website is legitimate or not before entering your personal or financial information. Internet users tend to believe in the padlock, but the SSL certificates don’t tell you anything about site legitimacy
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
