Security News > 2023 > August > Threat actors abuse Google AMP for evasive phishing attacks
Security researchers are warning of increased phishing activity that abuses Google Accelerated Mobile Pages to bypass email security measures and get to inboxes of enterprise employees.
Google AMP is an open-source HTML framework co-developed by Google and 30 partners to make web content load faster on mobile devices.
The idea behind using Google AMP URLs embedded in phishing emails is to make sure that email protection technology does not flag messages as malicious or suspicious due to Google's good reputation.
Data from anti-phishing protection company Cofense shows that the volume of phishing attacks employing AMP spiked spiked significantly towards mid-July, suggesting that threat actors may be adopting the method.
Cofense says the phishing actors who abuse the Google AMP service also employ a range of additional techniques that collectively help evade detection and increase their success rate.
The attackers used an extra redirection step, abusing a Microsoft.com URL to take the victim to a Google AMP domain and eventually to the actual phishing site.
News URL
Related news
- Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them (source)
- Ransomware gangs pose as IT support in Microsoft Teams phishing attacks (source)
- Google takes action after coder reports 'most sophisticated attack I've ever seen' (source)
- Microsoft Teams phishing attack alerts coming to everyone next month (source)
- Google: Over 57 Nation-State Threat Groups Using AI for Cyber Operations (source)
- Google to Iran: Yes, we see you using Gemini for phishing and scripting. We're onto you (source)
- Google says hackers abuse Gemini AI to empower their attacks (source)
- Google fixes Android kernel zero-day exploited in attacks (source)
- How to Prevent Phishing Attacks with Multi-Factor Authentication (source)
- Threat Actors Exploit ClickFix to Deploy NetSupport RAT in Latest Cyber Attacks (source)