Google Docs users hit by phishing attack

The attack was disguised as a Google Doc but was, in fact, a third-party app

Gmail app icon

Google Docs users were hit yesterday by a phishing attack which lets an attacker obtain contact lists and access Gmail accounts to spread spam messages on a large scale.

Reddit user JakeSteam detailed the process and wrote that the attack was disguised as an email from a person on a user's contact list, which invited them to edit a file in Google Docs. But clicking on the link wouldn't take users to a Google Doc. Instead, it would give a third-party app access to the user's emails and potentially perform a password reset too.

It would then replicate itself by sending emails to the user's contacts. It's also particularly dangerous as it bypasses any 2-factor authentication the user has set up.

Clicking on "Open in Docs" takes users to a new page and prompts them to sign in to continue to "Google Docs". By clicking on its name in "to continue to Google Docs" users were able to detect that it wasn't a genuine Google Doc. It then asked for permission to read, send, delete and manage users' email as well as managing their contacts. You can see this in the gif below:

Google responded to the scam within an hour of it launching and manage to stop it before it got out of hand.

Advertisement - Article continues below
Advertisement - Article continues below

"We realise people are concerned about their Google accounts, and we're now able to give a fuller explanation after further investigation. We have taken action to protect users against an email spam campaign impersonating Google Docs, which affected fewer than 0.1% of Gmail users," a Google spokesperson told IT Pro. 

They continued: "We protected users from this attack through a combination of automatic and manual actions, including removing the fake pages and applications, and pushing updates through Safe Browsing, Gmail, and other anti-abuse systems. We were able to stop the campaign within approximately one hour.

"While contact information was accessed and used by the campaign, our investigations show that no other data was exposed. There's no further action users need to take regarding this event; users who want to review third party apps connected to their account can visit Google Security Checkup."

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now


cloud computing

Google adds partners to real-time translation tools

8 Jan 2020

The IT Pro Products of the Year 2019: All the year’s best hardware

24 Dec 2019
search engine optimization (SEO)

Google is getting worse as it does more

21 Dec 2019
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Most Popular

operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020
General Data Protection Regulation (GDPR)

Data protection fines hit £100m during first 18 months of GDPR

20 Jan 2020