A new phishing technique is fooling internet users into giving hackers access to their Gmail accounts. According to WordPress security plugin creator Wordfence, the way that the attack works is that hackers send emails to the contacts of compromised accounts containing a seemingly innocuous attachment. When the user clicks the attachment, a new tab opens in the browser that looks nearly identical to the Google sign-in page. If the user inputs their log-in information, it goes straight to the attacker.
On Hacker News, a commenter describes an incident that occurred at his school last year in which several employees and students were tricked into handing over their account information to attackers after receiving compromised emails and opening the attachments, thus perpetuating the cycle:
“It’s the most sophisticated attack I’ve seen. The attackers log in to your account immediately once they get the credentials, and they use one of your actual attachments, along with one of your actual subject lines, and send it to people in your contact list.
For example, they went into one student’s account, pulled an attachment with an athletic team practice schedule, generated the screenshot, and then paired that with a subject line that was tangentially related, and emailed it to the other members of the athletic team.”
While the idea of having your Gmail account serve as a host for the chain of hacks to continue is frightening enough, the hackers will also have the ability to download and read through all of your private emails, as well as gain access to other information connected to your Google account (or whichever service is hacked).
Here’s what you need to look out for in your address bar to avoid this attack:
As you can see, not only is the beginning of the string odd, but there is a script hidden behind a long wall of whitespace. You won’t be able to see the script in your address bar without tapping on it and scrolling to the right, but there are several other signs to watch out for that are even more obvious.
For example, here’s what my address bar looks like when I navigate to Gmail in Chrome:
See the green text and the “Secure” label in front of the address? That indicates that I’ve reached a safe, secure website, as opposed to the black text up above. Not every site is going to be certifiably secure like that, but if you are visiting a Google log-in page specifically and don’t see it, alarms should go off in your head. Google might fix this eventually, but for now, just pay attention and look for green text.
Furthermore, if you don’t have two-factor authentication on your Google account (or any other account which contains sensitive information), treat this as a wake up call and set it up immediately.
UPDATE: A Google spokesperson provided the following comment regarding the attack:
“We’re aware of this issue and continue to strengthen our defenses against it. We help protect users from phishing attacks in a variety of ways, including: machine learning based detection of phishing messages, Safe Browsing warnings that notify users of dangerous links in emails and browsers, preventing suspicious account sign-ins, and more. Users can also activate two-step verification for additional account protection.”
