Sunday, December 3, 2023

Beware!! Scammers use Google Calendar Notifications to steal the User’s Money and Identity

Scammers are abusing Google Calendar services to trick victims into giving away the personal and financial information such as passwords, card details, or account IDs.

Calendar phishing is highly effective as it comes from trusted, legitimate services; it can even trick users who might not fall in other forms of attacks.

Kaspersky observed several unsolicited pop-up calendar notifications appearing for Gmail users as a result of sophisticated spam emails sent by scammers.

The emails aimed in exploiting “default feature for people using Gmail on their smartphone: the automatic addition and notification of calendar invitations,” states Kaspersky press release.

The attackers use to send an unsolicited calendar invitation that contains a phishing link, in the victims phone it pop-up notification in the smartphone and stir victim’s to click on the link.

Once the user click’s on the links, they are getting redirected to “website that featured a simple questionnaire and offered prize money upon completion.” To get the price, victims are asked to provide the card details and other personal information.

Instead of delivering the prize, the entered details are sent to the attacker’s server, who can use the information to steal money and to launch various attacks.

“The ‘calendar scam’ is a very useful scheme, as most people have become used to receiving spam messages from emails or messenger apps,” said Maria Vergelis, a security researcher at Kaspersky. “But this may not be the case when it comes to the Calendar app, which has the main purpose to organize information rather than transfer it.

Mitigations

To avoid the issue, researchers suggested to Turn off the automatic adding of invitations to your calendar.

You need to check the website is legitimate or not before entering your personal or financial information. Internet users tend to believe in the padlock, but the SSL certificates don’t tell you anything about site legitimacy

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles