Thursday, March 28, 2024

Beware!! Scammers use Google Calendar Notifications to steal the User’s Money and Identity

Scammers are abusing Google Calendar services to trick victims into giving away the personal and financial information such as passwords, card details, or account IDs.

Calendar phishing is highly effective as it comes from trusted, legitimate services; it can even trick users who might not fall in other forms of attacks.

Kaspersky observed several unsolicited pop-up calendar notifications appearing for Gmail users as a result of sophisticated spam emails sent by scammers.

The emails aimed in exploiting “default feature for people using Gmail on their smartphone: the automatic addition and notification of calendar invitations,” states Kaspersky press release.

The attackers use to send an unsolicited calendar invitation that contains a phishing link, in the victims phone it pop-up notification in the smartphone and stir victim’s to click on the link.

Once the user click’s on the links, they are getting redirected to “website that featured a simple questionnaire and offered prize money upon completion.” To get the price, victims are asked to provide the card details and other personal information.

Instead of delivering the prize, the entered details are sent to the attacker’s server, who can use the information to steal money and to launch various attacks.

“The ‘calendar scam’ is a very useful scheme, as most people have become used to receiving spam messages from emails or messenger apps,” said Maria Vergelis, a security researcher at Kaspersky. “But this may not be the case when it comes to the Calendar app, which has the main purpose to organize information rather than transfer it.

Mitigations

To avoid the issue, researchers suggested to Turn off the automatic adding of invitations to your calendar.

You need to check the website is legitimate or not before entering your personal or financial information. Internet users tend to believe in the padlock, but the SSL certificates don’t tell you anything about site legitimacy

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles