- Hackers abuse Google Tasks to send phishing emails
- Fake tasks trigger legitimate Google notifications, bypassing spam filters
- Victims see a trusted Google domain, but the links lead to credential-stealing pages disguised as login screens
Hackers are exploiting Google’s task service to launch phishing attacks and bypass spam filters.
Google Tasks is a simple task management app that’s part of its Workspace suite, helping users organize and track to-do lists and integrate them with Gmail, Google Calendar, and other Google services.
But a new report from Kaspersky warns: Cybercriminals have started creating fake tasks and assigning them to people by adding their email addresses. When this happens, Google automatically sends a notification to the email added to the task, bypassing all email protections and landing directly in the victim’s inbox.
Counter the threat
When the victim opens the email, they will see that it comes from a legitimate Google domain and follows the company’s usual email format. However, in the task description there is a link to a malicious landing page.
The landing page is designed to look like the usual Google login page, and people who click on it – especially those who are in a hurry – probably won’t see anything unusual there.
Those who attempt to log in this way will hand over their credentials to attackers, who can then take over their entire Google account and all the data stored there.
This isn’t the first and it certainly won’t be the last legitimate service abused in phishing campaigns. Cybercriminals were doing the same thing with Calendar. By setting up fake meetings and sending people notifications, they were able to abuse legitimate domains to bypass filters and send the emails to inboxes.
To counter this and similar threats, Kaspersky recommends users to be wary of all incoming emails, regardless of the sender’s address, carefully inspect all URLs before clicking, and warns against calling phone numbers contained in these emails.
“If you need to call support for a certain service, it is best to find the phone number on the official webpage of that service,” the researchers pointed out.
The best antivirus for every budget
Follow TechRadar on Google News And add us as your favorite source to get our news, reviews and expert opinions in your feeds. Make sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, unboxings in video form and receive regular updates from us on WhatsApp Also.
