0

I accidentally opened up a spam mail containing a google drive sheet with a macro on my Galaxy S8 phone. The spam email goes something like:

Headline: "Need action! Withdrawing Funds id - (some ID number)"

Body: "you got 6 hours to withdraw BTC from your account. All information attached in the link."

And then it contained a link to the spreadsheet. The author "tagged" me and some other people in a comment on the file like "@[email protected]".

The reason I accidentally opened the file was due to the fact that a "drive" notification popped up on my Galaxy S8 phone. I instantly realized what happened when it opened and quickly closed the app, reset my password for my gmail and logged out of a few things on my phone. I also (reported the sheet as malware to Google) and then panic deleted the sheet file that was now on my drive (and said "opened by you today at 6:00").

I am panicking because I am not tech-savvy and I don't know what to do. I have a few questions:

  1. Do Google Drive macros work on an Android phone?

  2. What are the right steps in order to prevent identity theft or anything else? I am willing to go far to protect myself.

I did not open the spreadsheet on my PC, but I reported it and deleted it from my PC. Sadly, I deleted everything including the corresponding spam email, so I don't have much for you to go on, other than it looked like a typical spam email and was reported as spam by Gmail (I've gotten a similar spam email looking exactly like the one I opened).

The email looked very similar to this one in the picture below.

similaremail

My hypothesis is that the macro in the spreadsheet is either a phishing attempt on stealing your cryptowallet details or something in regards to cryptocurrency. However, I am scared that it might be able to steal other things from my Phone (Notes, pictures, "password cookies" from apps like Dropbox?).

Improve this question
8
  • Will the macro run? Likely. It doesn't matter what device is used because you are running it in the cloud. What steps to take? That will depend on what the script was designed to do. We can't tell you what that is. The first step is to change your Google password and turn on MFA. Aside from that, we're guessing.
    – schroeder ♦
    Feb 2 at 9:01
  • @schroeder Thank you for your comment. I already changed my password, logged out on all devices and MFA was already turned on before the event. I was hoping that the macro needed some sort of permission before running, even though it was in the cloud, but perhaps not (because I did not give any permission, I only opened the document and briefly saw an empty spreadsheet before exiting it again). Since the email was very generic and followed the same "style" as the email shown in my picture, I have a hunch that the macro is based on the same "premise" as the link in the picture.
    – Unlucky7200
    Feb 2 at 9:33
  • As such, I was hoping that someone had "reversed engineered" the macro (or a similar style macro) as the one provided in the picture, in order to understand what it actually does. However, since this is not my area of expertise, I have no clue where to look or if this is even possible.
    – Unlucky7200
    Feb 2 at 9:36
  • We don't analyse code. And there is no guarantee that one malicious script would to the some thing as another.
    – schroeder ♦
    Feb 2 at 9:46
  • @schroeder okay. I know that they might be different, but the "way of attacking/hacking" could've been the same. I'll leave it at that. Since the macro runs in the cloud, will it then affect all devices logged in to my gmail/Google drive, including my PC? Also, do you have any other protective measures that I can do? I ran Bitdefender antivirus on my android phone and will run antivirus and anti-malware programs on my PC, when I'm home again. I simply don't know what else to do. Any tips are greatly appreciated.
    – Unlucky7200
    Feb 2 at 10:17

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .