June 12, 2019 By David Bisson 2 min read

Fraudsters are abusing a Google Calendar feature that’s commonly enabled on smartphones to target unsuspecting users with scam offers.

Kaspersky Lab came across the scam campaign after observing unsolicited pop-up calendar notifications targeting some of its mobile users via Gmail in May. Upon taking a closer look, the security firm found that these notifications abused a Gmail feature that’s commonly enabled by default on smartphones: the automatic addition and notification of calendar invitations within the mobile Gmail app. Fraudsters leveraged this capability to display a notification for their invitations on the home screen of each targeted smartphone user. These notifications encouraged users to click on a link included with the invitations.

When a user clicked the link, the attack chain redirected them to a website that offered prize money in exchange for filling out a questionnaire. This survey contained questions designed to steal users’ personal information, including their names, phone numbers and addresses. It also instructed users to complete a “fixing payment” with their credit cards, payment data that the scammers could then abuse to commit credit card fraud.

Calendar-Based Phishing Schemes

This scam campaign was unique in that it leveraged a common feature associated with the mobile Gmail app to deliver phishing calendar invitations. Even so, this was not the first calendar-based phishing scheme in general. All the way back in 2008, Naked Security came across a sample in which digital attackers used Google Calendar invitations to steal credentials. In January 2019, GMX found that calendar spam accounts had grown to account for 7 percent of all digital appointment invitations received by users.

How to Defend Against Mobile-Borne Scam Offers

Security professionals can help defend against mobile-borne scam offers by using ahead-of-threat detection to block malicious domains, including phishing attack landing pages, before they become active in ongoing attacks. Companies should also use ongoing employee awareness training to teach employees about common social engineering techniques.

More from

Unpacking the NIST cybersecurity framework 2.0

4 min read - The NIST cybersecurity framework (CSF) helps organizations improve risk management using common language that focuses on business drivers to enhance cybersecurity.NIST CSF 1.0 was released in February 2014, and version 1.1 in April 2018. In February 2024, NIST released its newest CSF iteration: 2.0. The journey to CSF 2.0 began with a request for information (RFI) in February 2022. Over the next two years, NIST engaged the cybersecurity community through analysis, workshops, comments and draft revision to refine existing standards…

What should Security Operations teams take away from the IBM X-Force 2024 Threat Intelligence Index?

3 min read - The IBM X-Force 2024 Threat Intelligence Index has been released. The headlines are in and among them are the fact that a global identity crisis is emerging. X-Force noted a 71% increase year-to-year in attacks using valid credentials.In this blog post, I’ll explore three cybersecurity recommendations from the Threat Intelligence Index, and define a checklist your Security Operations Center (SOC) should consider as you help your organization manage identity risk.The report identified six action items:Remove identity silosReduce the risk of…

Obtaining security clearance: Hurdles and requirements

3 min read - As security moves closer to the top of the operational priority list for private and public organizations, needing to obtain a security clearance for jobs is more commonplace. Security clearance is a prerequisite for a wide range of roles, especially those related to national security and defense.Obtaining that clearance, however, is far from simple. The process often involves scrutinizing one’s background, financial history and even personal character. Let’s briefly explore some of the hurdles, expectations and requirements of obtaining a…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today