Updated November 9 with further warnings from Google regarding the use of AI by attackers, following the latest Google security advisory, which included scam and fraud alerts for Gmail and users of other Google services.
Google is a prime target for all types of threat actors. From a recently reported surge in attacks against Google Calendar users, an exploit that can be used to freeze the Google Chrome browser, and password stealers that are using a humanized approach to grab Android credentials. Now Google has issued an updated warning for Gmail, Google Messages and Google Play about six scams that every user needs to be aware of, alongside protections that are already in place to help prevent the worst from happening. Here’s what you need to know.
Google’s Trust And Safety Teams Issue New Scams Advisory For All Users
“57% of adults experienced a scam in the past year, with 23% reporting money stolen,” Laurie Richardson, Google’s vice president of trust and safety, has confirmed in a new security advisory posting. The security and safety teams at Google have noted that scammers and threat actors are increasingly turning to AI tools to “efficiently scale and enhance their schemes.” The response has been to issue a new advisory, warning Google users of six scam trends to beware of, alongside details of the protections that Google has put in place within Gmail, Messages and Play to safeguard them from such attacks.
Before looking at the six scams that Google is alerting its users to, this seems like a great time to suggest that you take advantage of the inoculation theory-inspired security game that Google has made available, as it’s an excellent method of raising your own scam awareness game.
OK. So let’s take a look at some of the threats that Google users are being warned about, starting, appropriately enough, with an AI-inspired one.
“Cybercriminals are exploiting the widespread enthusiasm for AI tools by using it as a powerful social engineering lure,” Richardson said, creating “sophisticated scams impersonating popular AI services, promising free or exclusive access to ensnare victims.” Most often, these will come in the format of mobile and desktop apps or credential-stealing websites and browser extensions. Promotion, sadly, is through malicious ads, including what is known as cloaked malvertising, where scanners see harmless content, but users get the real and dangerous deal. “Google prohibits ads that distribute Malicious Software and enforces strict rules on Play and Chrome for apps and extension,’ Richardson said, with Google Play policies allowing for apps that mimic legitimate AI services to be proactively removed. Chrome, meanwhile, has a safe browsing enhanced mode, powered by AI, to provide real-time warnings to users.
Google Confirms Hackers Deploy Novel AI-Enabled Malware In Active Operations
Google’s world-renowned Threat Intelligence Group has also issued a warning of its own concerning the use of AI by attackers. The report, GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools, confirmed that GTIG researchers have observed a positive shift across the course of the last year, with threat actors deploying AI-enabled malware in ongoing attacks.
With a remit to identify, analyse, mitigate and eliminate cyber threats against Google, its services, platforms, customers and users, GTIG is perhaps best known for disclosing zero-day threats. However, it also invests in the necessary research to enhance AI security to identify threats, and as a result, it has seen an uptick in threat actors
“adopting social engineering-like pretexts in their prompts to bypass AI safety guardrails.”
One example given was that of a fake capture-the-flag security competition used to release otherwise blocked information from Gemini that could then be used for both vulnerability exploitation and attack tool development. The China-nexus threat actor was seen using the CTF approach in “support of phishing, exploitation, and web shell development.”
“Our policy guidelines and prohibited use policies prioritize safety and responsible use of Google’s generative AI tools,” Google said, adding that “we continuously enhance safeguards in our products to offer scaled protections to users across the globe.”
Google Warns Of Surge In Online Job Scams
Then there are the seemingly never-ending online job scams, which, Google warns, are rising in number. “These campaigns involve impersonating well-known companies through detailed imitations of official career pages, fake recruiter profiles, and fraudulent government recruitment postings distributed via phishing emails and deceptive advertisements across a range of platforms,” Richardson said. Google offers protection by way of the scam detection function of Google Messages, Gmail’s automatic phishing and scam email detection and two-factor authentication to help secure accounts.
You can read all of the scam threat warnings in the Google advisory itself, and I suggest you do so. In the meantime, stay safe out there.
Read the full article here
