This Powerful Google Tool is Being Used to Hack Microsoft Accounts

A new and increasingly sophisticated phishing scam has been spotted by cybersecurity researchers at Cofense, using Google Apps Script to automate emails that trick victims into giving away their Microsoft 365 credentials. This is just the latest example of how scammers are becoming more cunning in their attempts to steal sensitive information from unsuspecting users.

Phishing scams have become a major threat on the internet, with millions of dollars lost each year due to these types of attacks. They can take many forms, including emails, phone calls, and text messages, all designed to trick victims into revealing sensitive information. In this case, the scammers are using Google Apps Script to send out emails that appear to be legitimate invoices from Google.

The scam starts with an email claiming to be a notification from Google, with a link to a fake invoice that supposedly needs to be downloaded. The link points to script[.]google[.]com, which may seem innocuous at first glance due to the presence of "google.com" in the URL. However, this is where the scammers' cleverness comes into play.

When the victim clicks on the link, a window appears claiming that there is a pending download, and clicking the "download" button takes them to an almost identical replica of the Microsoft 365 login page. The malicious actors have set up a fake site that mirrors the official Microsoft website, complete with convincing logos and formatting.

Once the victim enters their login credentials into the fake site, the information is transmitted directly to the scammers. This means that even if the user is cautious and doesn't click on the link, they may still inadvertently reveal sensitive information.

The use of Google Apps Script in this scam makes it a particularly powerful tool for malicious actors. By automating the process of sending out emails and creating fake websites, the scammers can increase their chances of success and reach a wider audience.

So, what can you do to protect yourself from this type of attack? The most important thing is to be cautious when receiving unsolicited emails or notifications. If an email appears to be legitimate but contains a suspicious link or attachment, it's best to avoid clicking on it altogether. It's also a good idea to verify the authenticity of the sender and check for any spelling or grammar mistakes that may indicate a scam.

Most importantly, never provide sensitive information over the phone or via email, especially if you're prompted to do so by someone claiming to be from your bank or another reputable institution. If you receive an unexpected call or email requesting sensitive information, it's likely a phishing attempt and should be reported to the relevant authorities immediately.

By being vigilant and taking these precautions, you can reduce your risk of falling victim to this type of attack and protect yourself against cyber threats like this one. Stay safe online!