Tech giant Google has blocked 1.6 million phishing emails Since May 2021, which were part of a malware campaign aimed at stealing YouTube accounts and promoting cryptocurrency schemes.

According to Google’s Threat Analysis Group, in collaboration with YouTube, Gmail, Trust and Safety, CyberCrime Investigation Group and Safe Browsing teams, Google’s protections have decreased the volume of related phishing emails on Gmail by 99.6 per cent.

“We blocked 1.6M messages to targets, displayed 62K Safe Browsing phishing page warnings, blocked 2.4K files and successfully restored 4K accounts,” the company said in a blog post.

“With increased detection efforts, we have observed attackers shifting away from Gmail to other email providers (mostly email.cz, seznam.cz, post.cz and aol.com),” it added.

According to the report, the group tracks actors involved in disinformation campaigns, government backed hacking, and financially motivated abuse.

“Since late 2019, our team has disrupted financially motivated phishing campaigns targeting YouTubers with Cookie Theft malware,” the company said.

“The actors behind this campaign, which we attribute to a group of hackers recruited in a Russian-speaking forum, lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams,” it added.

In the blog post, Google shared examples of the specific tactics, techniques and procedures (TTPs) used to lure victims, as well as some guidance on how users can further protect themselves.

Cookie Theft, also known as “pass-the-cookie attack,” is a session hijacking technique that enables access to user accounts with session cookies stored in the browser.

While the technique has been around for decades, its resurgence as a top security risk could be due to a wider adoption of multi-factor authentication (MFA) making it difficult to conduct abuse, and shifting attacker focus to social engineering tactics, the company said.

Google has introduced a new Focus time entry in its Calendar to make scheduling dedicated work blocks easier.

Similar to the out of office event type, focus time has a different appearance on your calendar and includes the option to automatically decline conflicting events.

“With the changes to our working environments in the past year, having more chats and meetings make it more difficult for people to carve out time for their core individual work. With the new focus time feature, we hope to make it easier to create dedicated time for thinking and core work,” the firm said in a statement.

Focus time will have a different appearance on users’ calendars. It includes the option to automatically decline conflicting events.

The focus time entries have a small headphones icon calendar and can be given a different colour to help separate them.

In addition, there will be no admin control for this feature and it will be aOn’ by default for end users.

It will be available to Google Workspace Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, Education Fundamentals, Education Teaching & Learning Upgrade, Education Standard, Education Plus, and Nonprofits customers.

It will not be available to Google Workspace Essentials, Business Starter, Enterprise Essentials, and Frontline and as well as G Suite Basic and Business customers.