Google sent 50,000 warnings to users on govt-back hackings

San Francisco: Google has said that so far in 2021, it has sent over 50,000 warnings to those whose accounts were the target of government-backed phishing or malware attempts, a nearly 33 per cent increase from this time in 2020.

The company said that it intentionally sends these warnings in batches to all users who may be at risk, rather than the moment the company detects the threat itself so that attackers cannot track defence strategies.

"On any given day, TAG is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries. This means that there is typically more than one threat actor behind the warnings," the company said in a blogpost.

The blogpost mentioned that some of the most notable campaigns the company disrupted this year from a different government-backed attacker -- APT35 -- an Iranian group, which regularly conducts phishing campaigns targeting high-risk users.

For years, this group has hijacked accounts, deployed malware and used novel techniques to conduct espionage aligned with the interests of the Iranian government, the company said.

In early 2021, APT35 compromised a website affiliated with a UK university to host a phishing kit. Attackers sent email messages with links to this website to harvest credentials for platforms such as Gmail, Hotmail and Yahoo.

Users were instructed to activate an invitation to a (fake) webinar by logging in. The phishing kit will also ask for second-factor authentication codes sent to devices.

APT35 has relied on this technique since 2017 -- targeting high-value accounts in government, academia, journalism, NGOs, foreign policy aand national security.

Credential phishing through a compromised website demonstrates these attackers will go to great lengths to appear legitimate -- as they know it's difficult for users to detect this kind of attack.

Last year in May, Google discovered that APT35 attempted to upload spyware to the Google Play Store.

The app was disguised as VPN software that, if installed, could steal sensitive information such as call logs, text messages, contacts and location data from devices.

Google detected the app quickly and removed it from the Play Store before any users had a chance to install it.