Decide which fields you want to pre-fill. This will open a preview of the Google Form. Look for the 3 dots menu in the upper right and choose Get pre-filled link. Unlike regular spam, which Gmail does a pretty good job of filtering out, this message not only makes it into your inbox, it gets an added layer of legitimacy by coming from Google itself. A pre-filled link pre slots some of the answers when the user clicks on the link to the Google Form. An email notification created by the scam, which also comes from Google, also contains a potentially malicious link. If tapped, the notification takes you directly to a document that contains a very large, tempting link. As soon as youll open the form, it will fill it, submit it, go back to it, submit it, over and over. It uses document.querySelector to target the form elements. On mobile, the scam uses the collaboration feature in Google Drive to generate a push notification inviting people to collaborate on a document. It only works with the specific form you provided as an example. The smartest part of the scam is that the emails and notifications it generates come directly from Google. Bots are always getting smarter, so defeating them is a constant arms race.
The scam itself is nothing new – messages asking you to click on dodgy links are as old as the internet itself – but could catch a lot of people off guard. We at Fourth Wave Consulting have heard from a few companies that have recently been getting hit hard by spam bots, and have developed a custom solution to make your NetSuite forms (including Suitelets) spam resistant using Google’s free reCaptcha service. A flaw in the Drive is being exploited to send out seemingly legitimate emails and push notifications from Google that, if opened, could land people on malicious websites. Scammers just found a new phishing lure to play with: Google Drive.
0 kommentar(er)
