IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Google Docs users hit by phishing attack

The attack was disguised as a Google Doc but was, in fact, a third-party app

Gmail and YouTube icons on a smartphone screen

Google Docs users were hit yesterday by a phishing attack which lets an attacker obtain contact lists and access Gmail accounts to spread spam messages on a large scale.

Reddit user JakeSteam detailed the process and wrote that the attack was disguised as an email from a person on a user's contact list, which invited them to edit a file in Google Docs. But clicking on the link wouldn't take users to a Google Doc. Instead, it would give a third-party app access to the user's emails and potentially perform a password reset too.

It would then replicate itself by sending emails to the user's contacts. It's also particularly dangerous as it bypasses any 2-factor authentication the user has set up.

Clicking on "Open in Docs" takes users to a new page and prompts them to sign in to continue to "Google Docs". By clicking on its name in "to continue to Google Docs" users were able to detect that it wasn't a genuine Google Doc. It then asked for permission to read, send, delete and manage users' email as well as managing their contacts. You can see this in the gif below:

Google responded to the scam within an hour of it launching and manage to stop it before it got out of hand.

"We realise people are concerned about their Google accounts, and we're now able to give a fuller explanation after further investigation. We have taken action to protect users against an email spam campaign impersonating Google Docs, which affected fewer than 0.1% of Gmail users," a Google spokesperson told IT Pro. 

They continued: "We protected users from this attack through a combination of automatic and manual actions, including removing the fake pages and applications, and pushing updates through Safe Browsing, Gmail, and other anti-abuse systems. We were able to stop the campaign within approximately one hour.

"While contact information was accessed and used by the campaign, our investigations show that no other data was exposed. There's no further action users need to take regarding this event; users who want to review third party apps connected to their account can visit Google Security Checkup."

Featured Resources

ZTNA vs on-premises VPN

How ZTNA wins the network security game

Free Download

The global use of collaboration solutions in hybrid working environments

How companies manage security risks

Free Download

How to build a cyber-resilient business ready to innovate and thrive

Outperform your peers in your successful business outcomes

Free Download

Accelerating your IT transformation

How Cloudflare is innovating for CIOs to start 2023

Watch now

Recommended

Can Google Cloud realistically challenge GitHub Copilot with its Replit partnership?
artificial intelligence (AI)

Can Google Cloud realistically challenge GitHub Copilot with its Replit partnership?

29 Mar 2023
How to use Chromecast without Wi-Fi
Mobile

How to use Chromecast without Wi-Fi

9 Mar 2023
What you need to know about Gmail's new client-side encryption feature
Security

What you need to know about Gmail's new client-side encryption feature

28 Feb 2023
Google pays largest-ever bug bounty worth £500,000
Security

Google pays largest-ever bug bounty worth £500,000

23 Feb 2023

Most Popular

Tech pioneers call for six-month pause of "out-of-control" AI development
artificial intelligence (AI)

Tech pioneers call for six-month pause of "out-of-control" AI development

29 Mar 2023
Getting the best value from your remote support software
Advertisement Feature

Getting the best value from your remote support software

13 Mar 2023
3CX CEO confirms supply chain malware attack
malware

3CX CEO confirms supply chain malware attack

30 Mar 2023