{"id":1145,"date":"2023-09-14T11:00:47","date_gmt":"2023-09-14T18:00:47","guid":{"rendered":"https:\/\/blogs.pugetsound.edu\/infosec\/?p=1145"},"modified":"2023-09-14T11:00:48","modified_gmt":"2023-09-14T18:00:48","slug":"phishing-from-9-14-2023-document-shared-with-you-employee-review","status":"publish","type":"post","link":"https:\/\/blogs.pugetsound.edu\/infosec\/the-phish-tank\/1145","title":{"rendered":"Phishing from 9\/14\/2023: &#8220;Document shared with you: &#8216;EMPLOYEE REVIEW'&#8221;"},"content":{"rendered":"\n<p class=\"has-large-font-size\">Original Phishing Email<\/p>\n\n\n\n<p>From: Eric Estep (via Google Docs) &lt;drive-shares-dm-noreply[@]google[.]com><br>Subject: Document shared with you: &#8220;EMPLOYEE REVIEW&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"526\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-doc-share-phish-1024x526.png\" alt=\"\" class=\"wp-image-1146\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-doc-share-phish-1024x526.png 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-doc-share-phish-300x154.png 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-doc-share-phish-768x394.png 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-doc-share-phish-1536x789.png 1536w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-doc-share-phish-1440x739.png 1440w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-doc-share-phish.png 1556w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-large-font-size\">Where Did the Link Lead<\/p>\n\n\n\n<p>The link goes to a document hosted on Google Drive. Many phishing emails may utilize legitimate cloud services such as Google or OneDrive to make the links appear trusted. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"496\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-gdoc-phish-link-1024x496.png\" alt=\"\" class=\"wp-image-1147\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-gdoc-phish-link-1024x496.png 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-gdoc-phish-link-300x145.png 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-gdoc-phish-link-768x372.png 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-gdoc-phish-link-1536x745.png 1536w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-gdoc-phish-link-1440x698.png 1440w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-gdoc-phish-link.png 2042w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>The document then links to a form using another legitimate cloud service, Jotform, asking for your email and password. Never enter your credentials or sensitive information on web forms or on websites you do not recognize. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"675\" src=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-jotform-phish-link-1024x675.png\" alt=\"\" class=\"wp-image-1148\" srcset=\"https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-jotform-phish-link-1024x675.png 1024w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-jotform-phish-link-300x198.png 300w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-jotform-phish-link-768x506.png 768w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-jotform-phish-link-1536x1013.png 1536w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-jotform-phish-link-2048x1350.png 2048w, https:\/\/blogs.pugetsound.edu\/infosec\/files\/2023\/09\/9-14-23-jotform-phish-link-1440x949.png 1440w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"has-large-font-size\">Text of Phishing Message<\/p>\n\n\n\n<p>From: Eric Estep (via Google Docs) &lt;drive-shares-dm-noreply[@]google[.]com><br>Subject: Document shared with you: &#8220;EMPLOYEE REVIEW&#8221; <\/p>\n\n\n\n<p>Eric Estep shared a document<\/p>\n\n\n\n<p>Eric Estep (eric.estep[@]austinisd[.]org) has invited you to edit the following document:<\/p>\n\n\n\n<p>FWD:Amy Hackett (ATHLETIC DIRECTOR) HAS SHARED A FILE WITH YOU USING ONEDRIVE<br>EMPLOYEE REVIEW<\/p>\n\n\n\n<p>Eric Estep is outside your organization.<\/p>\n\n\n\n<p>Open<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Original Phishing Email From: Eric Estep (via Google Docs) &lt;drive-shares-dm-noreply[@]google[.]com>Subject: Document shared with you: &#8220;EMPLOYEE REVIEW&#8221; Where Did the Link Lead The link goes to a document hosted on Google Drive. Many phishing emails may utilize legitimate cloud services such as Google or OneDrive to make the links appear trusted. The document then links to [&hellip;]<\/p>\n","protected":false},"author":521,"featured_media":1146,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3,4],"class_list":["post-1145","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-the-phish-tank","tag-phishing","tag-phishtank"],"_links":{"self":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1145","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/users\/521"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/comments?post=1145"}],"version-history":[{"count":1,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1145\/revisions"}],"predecessor-version":[{"id":1149,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/posts\/1145\/revisions\/1149"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media\/1146"}],"wp:attachment":[{"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/media?parent=1145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/categories?post=1145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.pugetsound.edu\/infosec\/wp-json\/wp\/v2\/tags?post=1145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}