E-Business
Sophos Schools Google, Users After ‘Docs’ Users’ Phishing Scam

Following the disclosure by Google saying it has stopped a phishing email that reached about a million of its users, security firm Sophos has identified a number of factors Google should consider, going forward, on how best to manage cases like this.
Recall, the scam claimed to come from Google Docs – a service that allows people to share and edit documents online.
Users who clicked a link and followed instructions, risked giving the hackers access to their email accounts.
Google said it had stopped the attack “within approximately one hour”, including through “removing fake pages and applications”.
“While contact information was accessed and used by the campaign, our investigations show that no other data was exposed,” Google said in an updated statement.
“There’s no further action users need to take regarding this event; users who want to review third party apps connected to their account can visit Google Security Checkup.”
In an email to Nigeria CommunicationsWeek Chester Wisniewski, principal research scientist, Sophos, observed, “First and foremost, this is an abuse of Google’s APIs. While at first glance it appears to be a phishing attack, the emails come from Google and you are logging into the real Google”.
Wisniewski said that attacks on systems that are open for anyone to sign up as a developer using OAuth have been vulnerable to this type of attack for a long time, and the onus is on Google to do a better job vetting application developers.
“This is no different than the abuse of the Google Play store by malware authors. There is very little individuals can do other than be forever suspicious about legitimate requests from services provided by Google, Twitter, Facebook and other online services that use OAuth with an un-vetted application developer program. Twitter’s users were attacked using these techniques a few years back. Unfortunately, Google has also fallen victim to a similar attack vector. When users see official emails from Google and official login pages used in scams, this leads the goodwill Google has garnered from its users to be potentially damaged. All providers of OAuth have a responsibility to police the use of their platforms to stop users from being tricked through official requests from services like Google, Twitter and Facebook.
“We do suggest that users keep an eye on social media. As the Google Doc “phishing” attempt demonstrates, Twitter is a great early-warning system. There’s little doubt that the tweeted warnings saved people from being victimized.
“As a reminder, users should check the apps they have approved to access their accounts and remove anything that may be suspicious on all OAuth-based platforms. For Google it is under your Google account -> Sign-in & Security -> Connected apps & sites. On Twitter and Facebook it is Settings & Privacy -> Apps.
Sophos also went ahead to demonstrate how this type of attacks worked:
You get a real email from Google saying someone wants to share a file with you.
You get sent to a real Google login page and sign in.
You get a prompt that an “add on” wants access to your mail and contacts. The developer name is listed as “Google Docs,” but it could say anything (this is where Google could do more to prevent this).
The only way to attempt to check if it is real is to click on “Google Docs” and see the actual account creating the request, but it could say many believable things and there is no specific thing to watch for.
“The only reliable way to not fall victim is to never accept apps connecting to your account and requesting access to read/write your mail and contacts, or just about any other thing they might request access to unless you are specifically trying to hook into some new service, which you still may not be able to trust”.
Wisniewski also warned that when attacks like this happen, “it’s a good reminder to go back to your social media accounts and review what applications you’ve given permission to access your information and revoke permission if you no longer trust or use that particular app.”
E-Business
FG Launches Online Visa Approval Centre

Dr. Olubunmi Tunji-Ojo, minister of Interior, has announced the launch of an Online Visa Approval Center to eliminate bureaucratic bottlenecks and reduce corruption in the visa application process.
Commissioned by the President in December, the new system ensures that applicants no longer need to visit a visa office, know anyone in the system, or lobby for approvals.
At a stakeholders’ sensitisation workshop on the implementation of the Nigeria Visa Policy (NVP) 2025, yesterday in Abuja, Dr. Tunji-Ojo said the visa is considered a very important document by the government because it is an instrument of migration management and an instrument of economic development.
The minister explained that Nigeria has to strike a delicate balance between national security and, of course, the ease of migration.
“And we think that it’s something that we can do and something we will do.
“We don’t have a physical Visa Approval Center. If you apply for a Nigerian visa anywhere in the world, you do so online. We process it here in Nigeria, and if approved, you receive your e-visa in your email,” he explained.
To enhance efficiency, the government has set a 48-hour deadline for processing e-visas.
“It is unprofessional and unacceptable for the Nigeria Immigration Service not to approve or provide feedback within 48 hours,” the minister stated.
“It breaks my heart that people need to lobby to even get visas to Nigeria. It shouldn’t be so. It shouldn’t be.
“For anybody that is qualified, for anybody that wants to do legitimate activities in Nigeria, such people should be able to come to Nigeria easily. And this is why we are opening our space. Mr. President is interested in foreign direct investments.”
Further, he said Nigeria is interested in partnering with the rest of the world to develop its economy but, “We can’t do that when we allow bottlenecks to hold us down. So these reforms, basically, are aimed at opening our space, enhancing national security, and we hope that the primary responsibilities of the visa scheme will be achieved.”
Kemi Nandap, controller general, Nigeria Immigration Service (NIS), said the NIS would fully digitize its e-visa platform and reduce visa classifications from 79 to 44 to enhance accessibility, transparency, and efficiency in the new visa policy.
She said, “At the core of this policy is the new e-visa platform—a fully digitized, centralized system that revolutionizes how foreign nationals interact with our country’s entry procedures. As part of this transformation, the Nigerian Visa Policy 2024 underwent a comprehensive review, resulting in a significant reduction in visa classifications from 79 to 44.
“These categories have been logically grouped to simplify procedures, reduce complexities, and greatly improve the user experience. Importantly, we have maintained the original purpose and intent of each visa class throughout this reform.”
E-Business
NITDA Partners JICA to Launch Nigeria-Japan Startup Hub

Mr. Takao Shimokawa, director general, Economic Development Department at the Japan International Cooperation Agency (JICA) has visited the National Information Technology Development Agency (NITDA) to discuss the forthcoming launch of the Nigeria-Japan Startup Hub Project.

Mr. Dejo Olawunmi, director of IT Infrastructure Solutions at NITDA and Mr. Takao Shimokawa, director general, Economic Development Department at the Japan International Cooperation Agency (JICA)
This is in a strategic move to strengthen Nigeria’s startup ecosystem.
During his visit, Mr. Shimokawa was received by Mr. Dejo Olawunmi, director of IT Infrastructure Solutions at NITDA.
Their discussions focused on advancing technological innovation, fostering entrepreneurship, and enhancing venture capital development to support early-stage startups in Nigeria.
The Nigeria-Japan Startup Hub Project is designed to provide Nigerian startups with access to Japanese expertise, mentorship, and investment opportunities.
The initiative aims to create a collaborative environment where local entrepreneurs can scale their businesses by leveraging Japan’s advanced technology and business models.
By bridging Nigerian startups with Japanese investors and industry leaders, the project seeks to drive sustainable growth and innovation in Nigeria’s tech industry.
This partnership underscores the increasing economic and technological cooperation between the two nations, positioning Nigeria as a key player in the global startup landscape.
With the hub set to launch soon, stakeholders anticipate that it will provide critical resources for startups, enabling them to compete in the global market and contribute to Nigeria’s digital economy.
E-Business
Firm Discovers Sophisticated Chrome Zero-day Exploit Used in Active Attacks

Kaspersky has identified and helped patch a sophisticated zero-day vulnerability in Google Chrome (CVE-2025-2783) that allowed attackers to bypass the browser’s sandbox protection system.
The exploit, discovered by Kaspersky’s Global Research and Analysis Team (GReAT), required no user interaction beyond clicking a malicious link and demonstrated exceptional technical complexity. Kaspersky researchers have been acknowledged by Google for discovering and reporting this vulnerability.
In mid-March 2025, Kaspersky detected a wave of infections triggered when users clicked personalised phishing links delivered via email. After clicking, no additional action was needed to compromise their systems.
Once Kaspersky’s analysis confirmed that the exploit leveraged a previously unknown vulnerability in the latest version of Google Chrome, Kaspersky swiftly alerted Google’s security team. A security patch for the vulnerability was released on March 25, 2025.
Kaspersky researchers dubbed the campaign “Operation ForumTroll”, as attackers sent personalised phishing emails inviting recipients to the “Primakov Readings” forum. These lures targeted media outlets, educational institutions, and government organisations in Russia.
The malicious links were extremely short-lived to evade detection, and in most cases ultimately redirected to the legitimate website for “Primakov Readings” once the exploit was taken down.
The zero-day vulnerability in Chrome was only part of a chain that included at least two exploits: a still-unobtained remote code execution (RCE) exploit that apparently launched the attack, while the sandbox escape discovered by Kaspersky constituted the second stage. Analysis of the malware’s functionality suggests the operation was designed primarily for espionage. All evidence points to an Advanced Persistent Threat (APT) group.
“This vulnerability stands out among the dozens of zero-days we’ve discovered over the years,” said Boris Larin, principal security researcher at Kaspersky GReAT. “The exploit bypassed Chrome’s sandbox protection without performing any obviously malicious operations – it’s as if the security boundary simply didn’t exist.
The technical sophistication displayed here indicates development by highly skilled actors with substantial resources. We strongly advise all users to update their Google Chrome and any Chromium-based browser to the latest version to protect against this vulnerability.”
Google has credited Kaspersky for uncovering and reporting the issue, reflecting the company’s ongoing commitment to collaboration with the global cybersecurity community and ensuring user safety.
Kaspersky continues to investigate Operation ForumTroll. Further details, including a technical analysis of the exploits and malicious payload, will be released in a forthcoming report once Google Chrome user security is assured.
Meanwhile, all Kaspersky products detect and protect against this exploit chain and associated malware, ensuring users are shielded from the threat.
This discovery follows Kaspersky GReAT’s previous identification of another Chrome zero-day (CVE-2024-4947), which was exploited last year by the Lazarus APT group in a cryptocurrency theft campaign.
In that case, Kaspersky researchers found a type confusion bug in Google’s V8 JavaScript engine that enabled attackers to bypass security features through a fake cryptogame website.
- E-Business3 days ago
FG Plans to Link Social Register to NIN for Humanitarian Crisis
- Broadcasting3 days ago
We’re Confident in the Super Eagles – Karl Toriola
- Telecom3 days ago
Keystone Bank Seeks to Join Suit in Tussle over 9Mobile Shares Ownership
- E-Financial3 days ago
FG to Harmonise Fiscal Data Across MDAs
- E-Business3 days ago
Five WhatsApp Business Features Every Small Business Should Be Using
- News3 days ago
Senate Probes Federal Character Violations by NDIC, Others
- E-Financial3 days ago
Zumax Files N4.1Bn Suit against CBN over ‘Fraudulent’ Receivership
- News2 days ago
Court Throws Out Falana’s Fraud Case against Ekeh, Zinox Boss and Others