Massive Phishing Scam Rocks Google
On Wednesday afternoon a nationwide Google phishing scam affected thousands of email users. The scam crept into inboxes everywhere and politely invited the user to open a shared Google Doc. If opened, the same email would be blasted to that person’s contact list and with each opened Google Doc more and more emails flew out. Since Wednesday afternoon Google has successfully neutralized the issue but not before thousands of attacks.
These seemingly simple attacks come from internet spammers and cyber criminals looking to bait (fish…phishing…) users into quickly trusting the email and clicking links that lead to attacks like this. Wednesday’s email appeared to be sent from a familiar contact but upon closer inspection (whether or not that was too late) it was actually from a user with the address “hhhhhhhhhhhhhhhh@mailinator.com” – this user (s) have yet to be identified.
If you were one of the people that clicked “Allow” and as a result ended up sending out even more emails, the first thing you should do is Revoke Access to Google Docs. The real Google Docs does not require access (red flag), you can find this on your Permissions Page. You likely noticed immediately if you had been effected through emails bouncing back or follow up emails with a “did you mean to send this to me” or the unfortunate “I opened the Google Doc but it didn’t work” subject (sorry!).
Google released a statement Wednesday evening: “We have taken action to protect users against an email impersonating Google Docs, and have disabled offending accounts. We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail.”
Although the attack wasn’t able to retrieve personal data (like bank account information, passwords, etc.) it was still a highly sophisticated strategy these cyber scammers were using. These hackers were able to create a link that appeared to be authentic as well as being sent by a person the user knows from their contact list. Many blindly clicked the link and the phishing scam instantly took off – sending out to Gmail and non Gmail users. After the first hour Google successfully stifled the outbreak and any unopened emails had a red warning warding off the recipient to open. Although attacks like these aren’t uncommon, with this unique scam it is likely they’ll be more copycats to follow.
Top
