- 10,801
- 3,535
- Joined
- Sep 17, 2005
Figure I'd post this since half my studio got infected today.
I received a phishing email today, and very nearly fell for it. I'll go through the steps here:
1. I received an email that a Google Doc had been shared with me. Looked reasonably legit, and I recognized the sender.
2. The button's URL was somewhat suspicious, but still reasonably Google based.
3. I then got taken to a real Google account selection screen. It already knew about my 4 accounts, so it's really signing me into Google.
4. Upon selecting an account, no password was needed, I just needed to allow "Google Docs" to access my account.
5. If I click "Google Docs", it shows me it's actually published by a random gmail account, so that user would receive full access to my emails (and could presumably therefore perform password resets etc).
6. Shortly afterwards I received a followup real email from my contact, informing me: "Delete this is a spam email that spreads to your contacts."
To summarise, this spam email:
• Uses the existing Google login system
• Uses the name "Google Docs"
• Is only detectable as fake if you happen to click "Google Docs" whilst granting permission
• Replicates itself by sending itself to all your contacts
• Bypasses any 2 factor authentication / login alerts
• Will send scam emails to everyone you have ever emailed
________________________________________
FAQ
How do I know if I've been affected?
If you clicked "Allow", you've been hit. If you didn't click the link, closed the tab first, or pressed deny, you're okay! The app may have removed itself from your account, and may have deleted the sent emails.
What do I do if I've been affected?
1. Revoke access to "Google Docs".
2. Try and see if your account has sent any spam emails, and send a followup email linking to this post / with your own advice if so.
3. Inform whoever sent you the email about the spam emails, and that their account is compromised.
What are the effects?
All emails have been accessed, and the spam forwarded to all of your contacts. This means they could have all been extracted for reading later. Additionally, password reset emails could be sent for other services using the email address.
I'm a G Suite sysadmin, what do I do?
The following steps by/u/banden may help, but I can't verify they'll prevent it.
1. Block messages containing the [email protected] address from inbound and outbound mail gateway/spamav service.
2. Locate Accounts in Google Admin console and revoke access to Google Doc app.
Last edited: