January 18, 2017 — Savvy phishing attack targets Gmail accounts with high success rates
NuData’s VP of Business Development, Robert Capps, comments on a new phishing campaign with a high success rate for compromising accounts targeting Gmail accounts.
Wordfence researchers spotted a new phishing campaign with a high success rate for compromising accounts targeting Gmail account.
The attacker sends an email to a victim’s account that may come from someone you know who had previously had their account hacked in a similar manner, according to a 12 January blog post.
The phishing email may contain something that looks like the image of an attachment you would recognize from the sender. Once a victim clicks on the image instead of a preview of the attachments showing up, a new tab opens prompting them to log into their Gmail account.
At first glance, the URL for the new window contains accounts.google.com but upon further inspection one would notice the URL is a fraud. Once a user has entered their information into the phishing page attackers have access to a user’s complete account and have been known to log into accounts immediately after getting the credentials. The technique has also been used to steal credentials from other platforms.
“This level of sophisticated phishing attack has the potential to fool even the savviest of users,” Robert Capps, vice president of Business Development at NuData Security, told SC. “It’s a sad reality that users must maintain their vigilance online by assuming we’re all working and playing in a hostile environment.”
Bryan Burns, vice president of Threat Research at Proofpoint said there’s nothing new about Gmail/gdocs phishing, which is also prevalent in Office 365, Dropbox and Drive.
For the complete article, go here.