A Google phishing scam has been discovered infiltrated online accounts over the past couple of days. Emails have been sent in the millions asking individuals to edit Google Docs files. The emails seem to have been sent by known people, increasing the chance of the messages being opened and the links being visited.
Different to many email scams that include a link to a spoofed website, this scam brings directs the recipient to Google Docs. When the user arrives at the site they will be shown an authentic Google sign-in screen.
The Google phishing scam operates within the Google platform, taking advantage of the fact that people can set up a third-party app and give it a misleading name. On this occasion, the app has been named ‘Google Docs.’
This makes it look like Google Docs is asking for permission to read, send, delete, and manage emails and access the user’s contacts. However, it is the creator of the app that is asking to be granted those permissions. If users look closely at the developer name, they will see that all is not as it seems. Many people will not check, since the permission screen also includes Google logos.
Signing in will give the hacker access to the user’s Google account, including their emails, Google Docs files, and contact list. Additionally, signing in on the website will also result in the victim’s contact list being sent similar invitations. Unsurprisingly, many have been tricked by the Google phishing scam and countless emails are still doing the rounds.
The scam seems to have begun at some point on Wednesday. Google has now released an official statement saying it is taking action to protect users and has turned off the accounts that are being used to conduct the scam.
Google confirmed the actions it has taken to address the phishing scam, saying “We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail.”
Anyone who is sent a request to edit a Google Doc should treat the request with suspicion, even if it has been sent from someone the recipient is familiar with.
If you feel you may have tricked by this phishing scam it is likely that emails will already have been generated and sent to your contacts. However, you can take action to block the threat by revoking the access rights you have given to the app through the Connected Apps and Sites webpage.
The Google phishing scam is very realistic and clearly shows how sophisticated hackers are getting in their attempts to gain access to sensitive information and why it is imperative that email users be permanently careful.
