Doing their part, Google adds new functionality that defaults to automatically adding Google-based calendar invites to a victim’s calendar to lower the malicious value of an invite.
I’ve covered previously how threat actors use legitimate Google calendar invites as a way of reaching a victim’s inbox and delivering a malicious link disguised as a “meet [dot] google [dot} com” link. This crafty phishing attack method leverages Google’s credibility, and disguises the malicious link as something benign and “safe” for the victim to click to find out more about the invitation.
In “response”, Google has added new functionality that allows Google Calendar users to not have invitations automatically added to their calendar until they RSVP to the event invitation. This puts the users squarely in the driver’s seat; if an invite is automatically added, it also adds some degree of credibility to the user. With the new feature, users need to determine themselves whether the invite is legitimate or not.
And, because of the potential maliciousness of these invites, therein lies the rub; your users will be the determining factor of whether this malicious attack is successful or not. No security solution can assist here; it’s all up to your users. And even with the new feature, users still need to be taught – usually through Security Awareness Training – that any unexpected and out of the ordinary invite should be considered malicious until proven otherwise.
Here's how it works:
