{"id":954,"date":"2026-01-30T18:02:55","date_gmt":"2026-01-30T18:02:55","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/"},"modified":"2026-01-30T18:02:55","modified_gmt":"2026-01-30T18:02:55","slug":"google-presentations-abused-for-phishing-fri-jan-30th","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/","title":{"rendered":"Google Presentations Abused for Phishing, (Fri, Jan 30th)"},"content":{"rendered":"<div>\n<p>Charlie, one of our readers, has forwarded an interesting phishing email. The email was sent to users of the Vivladi Webmail service. While not overly convincing, the email is likely sufficient to trick a non-empty group of users:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png\" style=\"width: 400px; height: 256px;\"><\/p>\n<p>The e-mail gets more interesting as the user clicks on the link. The link points to Google Documents and displays a slide show:<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/Screenshot%202026-01-30%20at%2012_31_30%E2%80%AFPM.png\" style=\"width: 300px; height: 201px;\"><\/p>\n<p>Usually, Google Docs displays a footer notice that warns viewers about phishing sites and offers a &#8220;reporting&#8221; link if a page is used for phishing. Bots are missing in this case. At first, I suspected some HTML\/JavaScript\/CSS tricks, but it turns out that this isn&#8217;t a bug; it is a feature!<\/p>\n<p>Usually, if a user shares slides, the document opens in an &#8220;edit&#8221; window. This can be avoided by replacing &#8220;edit&#8221; with &#8220;preview&#8221; in the URL, but the footer still makes it obvious that this is a set of slides. To remove the footer, the slides have to be &#8220;published,&#8221; and the resulting link must be shared. When publishing, the slides will auto-advance. But for a one-slide slideshow, this isn&#8217;t an issue. There is also a setting to delay the advance. Here are some sample links:<\/p>\n<p>[These links point to a simple sample presentation I created, not the phishing version.]<\/p>\n<p>Normal Share:<\/p>\n<p>https:\/\/docs.google.com\/presentation\/d\/1Quzd6bbuPlIcTOorlUDzSuJCXiOyqBTSHczo6hnXcac\/edit?usp=sharing<\/p>\n<p>Preview Share:<\/p>\n<p>https:\/\/docs.google.com\/presentation\/d\/1Quzd6bbuPlIcTOorlUDzSuJCXiOyqBTSHczo6hnXcac\/preview?usp=sharing<\/p>\n<p>Publish Share:<\/p>\n<p>https:\/\/docs.google.com\/presentation\/d\/e\/2PACX-1vRaoBusJAaIoVcNbGsfVyE0OuTP1dS-2Po9lpAN9GGy2EkbZG_oR9maZDS7cq2xW_QeiF8he457hq3_\/pub?start=false&#038;loop=false&#038;delayms=30000<\/p>\n<p>The URL parameters in the last link do not start the presentations, nor loop them, and delay the next slide by 30 seconds.<\/p>\n<p>The Vivaldi webmail phishing ended up on a &#8220;classic&#8221; phishing login form that was created using Square. So far, this form is still visible at<\/p>\n<p>hxxps [:] \/\/vivaldiwebmailaccountsservices[.]weeblysite[.]com<\/p>\n<p><img decoding=\"async\" alt=\"\" src=\"https:\/\/isc.sans.edu\/diaryimages\/images\/Screenshot%202026-01-30%20at%2012_41_24%E2%80%AFPM.png\" style=\"width: 300px; height: 223px;\">???????<\/p>\n<p>\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>&#8212;<br \/>\nJohannes B. Ullrich, Ph.D. , Dean of Research, <a href=\"https:\/\/sans.edu\/\">SANS.edu<\/a><br \/>\n<a href=\"https:\/\/jbu.me\/164\">Twitter<\/a>|<\/p>\n<p> (c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Charlie, one of our readers, has forwarded an interesting phishing email. The email was sent to users of the Vivladi Webmail service. While not overly convincing, the email is likely sufficient to trick a non-empty group of users: The e-mail gets more interesting as the user clicks on the link. The link points to Google [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[90],"tags":[91],"class_list":["post-954","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","tag-cybersecurity"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Google Presentations Abused for Phishing, (Fri, Jan 30th) - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Google Presentations Abused for Phishing, (Fri, Jan 30th) - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"Charlie, one of our readers, has forwarded an interesting phishing email. The email was sent to users of the Vivladi Webmail service. While not overly convincing, the email is likely sufficient to trick a non-empty group of users: The e-mail gets more interesting as the user clicks on the link. The link points to Google [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-30T18:02:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Google Presentations Abused for Phishing, (Fri, Jan 30th)\",\"datePublished\":\"2026-01-30T18:02:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/\"},\"wordCount\":361,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/\",\"name\":\"Google Presentations Abused for Phishing, (Fri, Jan 30th) - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png\",\"datePublished\":\"2026-01-30T18:02:55+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#primaryimage\",\"url\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png\",\"contentUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Google Presentations Abused for Phishing, (Fri, Jan 30th)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Google Presentations Abused for Phishing, (Fri, Jan 30th) - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/","og_locale":"en_US","og_type":"article","og_title":"Google Presentations Abused for Phishing, (Fri, Jan 30th) - Imperative Business Ventures Limited","og_description":"Charlie, one of our readers, has forwarded an interesting phishing email. The email was sent to users of the Vivladi Webmail service. While not overly convincing, the email is likely sufficient to trick a non-empty group of users: The e-mail gets more interesting as the user clicks on the link. The link points to Google [&hellip;]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-01-30T18:02:55+00:00","og_image":[{"url":"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Google Presentations Abused for Phishing, (Fri, Jan 30th)","datePublished":"2026-01-30T18:02:55+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/"},"wordCount":361,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png","keywords":["Cybersecurity"],"articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/","name":"Google Presentations Abused for Phishing, (Fri, Jan 30th) - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png","datePublished":"2026-01-30T18:02:55+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#primaryimage","url":"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png","contentUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/vivaldiphish1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/30\/google-presentations-abused-for-phishing-fri-jan-30th\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Google Presentations Abused for Phishing, (Fri, Jan 30th)"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/954","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=954"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/954\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=954"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=954"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=954"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}