Full Report
Check Point research reveals cybercriminals are using Google Calendar and Drawings to send malicious links, bypassing traditional email security
Analysis Summary
# Tool/Technique: Google Calendar/Drawings Abuse for Malicious Link Delivery
## Overview
A social engineering technique observed by Check Point where threat actors leverage legitimate Google services, specifically Google Calendar and Google Drawings, to bypass existing email security controls and deliver malicious links to potential victims, primarily for financial fraud and information theft.
## Technical Details
- Type: Technique (Social Engineering/Delivery Mechanism)
- Platform: Users utilizing Google Workspace (Gmail/Calendar)
- Capabilities: Bypassing email security policies, link obfuscation, sender spoofing via legitimate services.
- First Seen: Research highlighted in December 2024, confirming ongoing evolution of this method.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing
- T1566.001 - Spearphishing Attachment (Via .ics calendar file)
- **TA0005 - Defense Evasion**
- T1204 - User Execution
- T1204.002 - Malicious File
## Functionality
### Core Capabilities
- **Delivery via Calendar Invites:** Malicious URLs are embedded within event descriptions or attachments (e.g., .ics files) sent via Google Calendar invites.
- **Evasion:** By routing links through Google Forms or Google Drawings, the attack aligns with legitimate traffic patterns originating from trusted Google domains, bypassing legacy email scanning rules designed to flag suspicious external links.
- **Sender Spoofing:** Attackers modify "sender" headers to make the email appear as if it legitimately originated from Google Calendar on behalf of a known contact.
### Advanced Features
- **Multi-Step Redirection:** The initial link within the calendar directs the user to click a secondary link, often disguised as a fake reCAPTCHA or support button.
- **Financial Scam Landing Pages:** The final destination leverages convincing facades, such as cryptocurrency mining pages or bitcoin support sites, to trick users into performing fake authentication or providing payment details.
- **Information Harvesting:** The ultimate goal of the final landing pages is the theft of corporate/personal information, leading to financial scams (e.g., credit card fraud) or credential reuse for further account compromise.
## Indicators of Compromise
- File Hashes: N/A (Mechanism focused on link sharing, not malware binary deployment)
- File Names: .ics files associated with unexpected calendar events.
- Registry Keys: N/A
- Network Indicators: Redirects to pages resembling cryptocurrency support/mining sites after initial click. Specific URLs are highly variable, but patterns involve links pointing to Google Forms/Drawings as an intermediary.
- Behavioral Indicators: Users clicking on links within calendar invitations that redirect to unknown authentication or payment prompts. Unusual navigation to cryptocurrency-related sites following an unexpected calendar event.
## Associated Threat Actors
- Threat actors engaged in financial scams and corporate/personal information theft. (Specific groups not named in the summary, but described as "cybercriminals.")
## Detection Methods
- Signature-based detection: Limited effectiveness against the initial delivery mechanism due to reliance on trusted Google infrastructure.
- Behavioral detection: Essential for identifying the multi-step redirection, suspicious user interaction with cryptocurrency/payment pages, and anomalous navigation patterns.
- YARA rules: Not explicitly mentioned for this delivery mechanism, but signature YARAs would target the content of the final scam pages.
## Mitigation Strategies
- **User Configuration:** Enable the "known senders" setting in Google Calendar to alert users when receiving invitations from unknown contacts.
- **Email Security:** Implement advanced email security platforms capable of blocking sophisticated, multi-stage phishing attempts.
- **Application Monitoring:** Monitor the use of third-party Google Apps for suspicious activity linked to account compromise.
- **Authentication:** Switch on Multi-Factor Authentication (MFA) across all business accounts to mitigate identity theft resulting from credential harvesting.
- **Analytics:** Deploy behavior analytics tools to detect unusual login attempts or suspicious navigation to cryptocurrency-related sites.
## Related Tools/Techniques
- Standard Phishing/Spearphishing campaigns.
- Use of trusted cloud services (Dropbox, OneDrive, etc.) as initial file hosts to evade URL blacklisting.
- Calendar spam campaigns (observed in prior incidents).