Office workers urged to beware cloud-based hacking attempts

Office workers need to be extra cautious when using cloud-connected equipment, as that is the time when they’re most vulnerable to cyberattacks, a new report has found.

The report from computer security firm Netskope highlighted the most common ways hackers are able to gain access to corporate computer systems, and most of them involve the cloud.

Netskope says that by infecting someone’s computer using cloud-based corporate servers, hackers can quickly gain access to confidential company data. Another favorite trick hackers like to do is impersonate a worker using their professional email account to gain access to sensitive information.

Employees are warned to be especially wary of emails from what looks to be a legitimate company. One of the favorite tactics today is to send a fake invoice, Netskope said. In addition, email is commonly used in “phishing” attacks, where a hacker sends what appears to be a legitimate email from a well-known company or service provider, asking the user to click a link and then login with their personal details. In such attacks, the website is a fake version of a legitimate company’s website, designed to steal information.

Ray Canzanese, Threat Research Director at Netskope, said people need to be aware that the same apps they you use for legitimate purposes can be attacked and abused. “Locking down cloud apps can help to prevent attackers from infiltrating them, while scanning for incoming threats and outgoing data can help block malware downloads and data exfiltration,” he said.

Netskope said Google Drive was the top app for malware downloads in 2021. The percentage of malware downloads via cloud apps was about 66% in 2021, up from 46% a year before.

“Abuse of cloud storage is an industry-wide issue and we’re constantly working to reduce the use of Microsoft services to cause harm,” a spokesperson for Microsoft told MarketWatch about the findings in the report. The company advises people to be cautious when clicking on links to websites, opening unknown files or accepting file transfers.