For scammers, it’s a clever way of putting a malicious link right in front of a potential victim. In a work setting, this could be a colleague asking you to check over a slide in a presentation or a brief for a new project. By default, Drive wants you to know when someone has mentioned you on a document.

And Google Drive is pretty accommodating. The success of email spam filters has left scammers looking for new ways to get people to click on malicious links. Unlike regular spam, which Gmail does a pretty good job of filtering out, this message not only makes it into your inbox, it gets an added layer of legitimacy by coming from Google itself. An email notification created by the scam, which also comes from Google, also contains a potentially malicious link. If tapped, the notification takes you directly to a document that contains a very large, tempting link. On mobile, the scam uses the collaboration feature in Google Drive to generate a push notification inviting people to collaborate on a document. The smartest part of the scam is that the emails and notifications it generates come directly from Google. (And make that request text-only, so there's no room for phishing.This story originally appeared on WIRED UK. If you close access and someone outside of your contacts wants to share anything with you, they'd have to request to do so beforehand. Better yet, make that the default, and let those who want to open up their email address opt out of it manually so it's a conscious choice. Let users set privacy preferences in Calendar, Drive, and Photos to only allow event invites or file shares and mentions from people in their contacts. The only way to stop this kind of abuse is to nip it in the bud. Using algorithms to detect spam after it happens is clearly not a solution to this recurring problem, because as long as there's a door, whether it's wide open or slightly ajar, scammers will slip right in.

Even when there's no large-scale spam campaign like this one, there are always small ones affecting users here and there. Google says it's working on stopping this new phishing method, but we all know a new one will come sooner or later.

Google drive spam notifications