Smart Tech and Slick Impersonators: Keeping it Real in the G Suite

As we move closer to the holiday break, the noise in our inboxes usually goes up—and that’s exactly what attackers are counting on. Today, we’re examining a massive new botnet targeting home gadgets and a particularly clever trick hackers are using to gain access to Google Workspace accounts.
Since these scams often attempt to impersonate people you know, we want to ensure you know exactly how to distinguish between a genuine IT request and a fake one.

1. The “Smart” Trap: Nearly 2 Million TVs Hijacked
A major report just came out showing that a botnet (a network of hijacked devices) has taken control of over 1.8 million Android-based TVs and streaming boxes. * The Goal: These devices are being used as “proxies” to hide criminal activity.

• The Lesson: If you’re grabbing new tech for the house this month, stick to big-name brands and the official Google Play Store. Budget streaming boxes from unknown vendors often come “pre-loaded” with malware that slows down your home Wi-Fi and puts your entire network at risk.

2. The Google “OAuth” Permission Trick
Attackers are moving away from just stealing passwords. Now, they are sending fake Google Drive or Doc “sharing” notifications that ask you to “Grant Access” or “Authorize an App.”

• The Trap: If you click “Allow,” you aren’t just logging in—you are giving an external app permanent permission to read your emails and files. This bypasses your password and MFA entirely.
• The Rule: If you get a pop-up asking to authorize an app you didn’t personally install, deny the request. —

3. Is that really IT? How to be 100% Sure
Attackers are getting incredibly good at pretending to be your coworkers. If you ever receive a message—via email, text, or even a LinkedIn DM—that claims to be from our IT department and asks for a password, an MFA code, or to “click here to fix a system error,” remember our golden rule:
Our IT team will never ask you for your password or a random authorization code out of the blue.
If something feels even slightly off, don’t just reply to the message. Use our “Internal Verification” protocol:

1. Verify via Slack: Send a quick direct message to that specific person in IT on Slack. It’s the fastest way to confirm it’s really them.
2. Check the Google Suite Identity: If you’re in Gmail, hover over the sender’s profile picture. Within our G Suite, it should show their official corporate contact card and organizational info.
3. Reach Out Directly: If you’re still unsure, start a new email thread to them or ping them in a known team channel.

Verify before you act. A 10-second Slack message to a teammate is the easiest way to stop an impersonation attack in its tracks.

 Protect the Team
Please share this with any colleagues who might have missed it. As the year winds down, these simple verification steps are our best line of defense. By looking out for one another and using our internal channels to verify requests, we make sure the holiday season stays safe for everyone.
Stay sharp, stay secure!