Google Takes a Step Towards Reducing the Use of Calendar Invitations as Phishing Tools

Google Calendar Reduce Use of Calendar Invites for Phishing ToolsDoing their part, Google adds new functionality that defaults to automatically adding Google-based calendar invites to a victim’s calendar to lower the malicious value of an invite.

I’ve covered previously how threat actors use legitimate Google calendar invites as a way of reaching a victim’s inbox and delivering a malicious link disguised as a “meet [dot] google [dot} com” link. This crafty phishing attack method leverages Google’s credibility, and disguises the malicious link as something benign and “safe” for the victim to click to find out more about the invitation.

In “response”, Google has added new functionality that allows Google Calendar users to not have invitations automatically added to their calendar until they RSVP to the event invitation. This puts the users squarely in the driver’s seat; if an invite is automatically added, it also adds some degree of credibility to the user. With the new feature, users need to determine themselves whether the invite is legitimate or not.

And, because of the potential maliciousness of these invites, therein lies the rub; your users will be the determining factor of whether this malicious attack is successful or not. No security solution can assist here; it’s all up to your users. And even with the new feature, users still need to be taught – usually through Security Awareness Training – that any unexpected and out of the ordinary invite should be considered malicious until proven otherwise.

Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Topics: Phishing

Subscribe To Our Blog

Anti-Phishing Guide ebook

Get the latest about social engineering

Subscribe to CyberheistNews