Hackers Are Using Google.com to Deliver Malware

The security firm C/side discovered a cybersecurity flaw where attackers use Google’s OAuth logout URL to inject malware.

This weaponization of Google OAuth is a new cybersecurity danger that is not only difficult for users to detect but also a challenge for security tools to spot – making this a critical security weakness.

• Hackers create a fictitious Google OAuth logout URL that seems legitimate.
• The Google OAuth logout URL is contained in a script and pulled from an unexpected location.
• The URL is weaponized with a callback parameter to run an obfuscated JavaScript payload.
• The unencrypted payload builds a malicious WebSocket link to the hacker’s controlled domain.
• After a successful WebSocket connection, hackers gain entry to the victim’s browser, allowing them to inject malware into the device.

This cybersecurity threat is especially harmful since it combines domain spoofing with concealed loaders. Therefore, even the most modern and advanced antivirus software will struggle to identify it.

The implications of this type of attack include:

• Malware distribution
• Data breach/theft
• Browser control
• Financial loss
• Reputation damage

Every day, hackers develop new ways to gain illegitimate access to people’s devices and businesses’ security infrastructure. One common mistake that makes their job easier is undervaluing the need for robust internet security solutions. To ensure you’re protected, there’s nothing like following our recommended cybersecurity steps for everyday users or best practices for small businesses.

Anyone who regularly uses a computer, smartphone, or tablet should always use antivirus software to build a protective wall against imminent cyberthreats.