Thursday, March 28, 2024

Beware!! Scammers use Google Calendar Notifications to steal the User’s Money and Identity

Scammers are abusing Google Calendar services to trick victims into giving away the personal and financial information such as passwords, card details, or account IDs.

Calendar phishing is highly effective as it comes from trusted, legitimate services; it can even trick users who might not fall in other forms of attacks.

Kaspersky observed several unsolicited pop-up calendar notifications appearing for Gmail users as a result of sophisticated spam emails sent by scammers.

The emails aimed in exploiting “default feature for people using Gmail on their smartphone: the automatic addition and notification of calendar invitations,” states Kaspersky press release.

The attackers use to send an unsolicited calendar invitation that contains a phishing link, in the victims phone it pop-up notification in the smartphone and stir victim’s to click on the link.

Once the user click’s on the links, they are getting redirected to “website that featured a simple questionnaire and offered prize money upon completion.” To get the price, victims are asked to provide the card details and other personal information.

Instead of delivering the prize, the entered details are sent to the attacker’s server, who can use the information to steal money and to launch various attacks.

“The ‘calendar scam’ is a very useful scheme, as most people have become used to receiving spam messages from emails or messenger apps,” said Maria Vergelis, a security researcher at Kaspersky. “But this may not be the case when it comes to the Calendar app, which has the main purpose to organize information rather than transfer it.

Mitigations

To avoid the issue, researchers suggested to Turn off the automatic adding of invitations to your calendar.

You need to check the website is legitimate or not before entering your personal or financial information. Internet users tend to believe in the padlock, but the SSL certificates don’t tell you anything about site legitimacy

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles