In recent times, there has been an increase in phishing activity that abuses Google Accelerated Mobile Pages (AMP) to bypass email security measures and get to the inboxes of enterprise employees. This has been a cause of concern for security researchers and organizations alike.
What is Google AMP?
Google AMP is an open-source HTML framework co-developed by Google and 30 partners to make web content load faster on mobile devices. It is designed to improve the user experience by providing faster loading times for web pages. However, threat actors have found a way to abuse this technology for malicious purposes.
How are attackers using Google AMP?
According to a report by Bleeping Computers, attackers are using Google AMP to create phishing pages that can bypass email security measures. These pages are designed to look like legitimate login pages for popular services such as Microsoft Office 365 or Google Workspace. Unsuspecting users who enter their credentials into these fake login pages risk having their accounts compromised.
The use of Google AMP in phishing attacks is particularly concerning because it allows attackers to create pages that are difficult to detect by traditional security measures. AMP pages are hosted on Google's servers, meaning they have a high level of trust and legitimacy. This makes it easier for attackers to bypass email security measures and get their phishing emails into the inboxes of enterprise employees.
What can organizations do?
Organizations need to be aware of this threat and take steps to protect themselves from these types of attacks. This can include educating employees about the dangers of phishing and how to spot fake login pages, as well as implementing advanced email security measures to detect and block phishing emails that use Google AMP.
The abuse of Google AMP by threat actors for evasive phishing attacks is a growing concern for organizations. Companies must stay vigilant and take steps to protect themselves from these types of attacks. By being proactive and implementing strong security measures, organizations can reduce their risk of falling victim to these attacks.