Pretty Convincing Google Docs Phishing Scam is Making the Rounds, Google is Investigating (Updated)

Pretty Convincing Google Docs Phishing Scam is Making the Rounds, Google is Investigating (Updated)

You may have received an email today that looked a lot like an email you get when a colleague or contact shares with you a Google Docs file. If so, you should be careful and double check that it’s actually from that someone. I say that because a pretty convincing Google Docs phishing scam is making the rounds at the moment. 

Emails are showing up in inboxes (ours included) that look like the email images I’ve included in this post, from an email address of “hhhhhhhhhhhhhhhh@mailinator.com” along with a contact of yours. Pretty realistic, right? Should you actually click the “Open in Docs” button in the email, you’ll likely be asked to select a Google account before giving something called “Google Docs” a whole bunch of permissions or access to your selected Google account. That’s a bad thing and could lead to other very bad things.

As noted by this reddit user, who provides images of the entire process, you are basically giving someone full access to your Google account should you allow it. You are not actually accessing a Google Docs file because none were actually shared with you. Once you have given up access, your contacts are exposed and emailed the same scam, but you may also be vulnerable to someone having control over your account. Scary stuff, for sure.

google docs phishing scam1

Thankfully, Google is already on it and may have resolved the issue, according to someone claiming to be a Googler in that reddit thread I just linked to. I’m not sure what that means, but I’m hoping they will find the phishing scam and remove it from inboxes before it spreads further. If anything, we know that the official Gmail Twitter account has acknowledged the phishing email and warns users to avoid it. They are investigating it.

So, if you get any weird looking Google Docs requests today, be careful. If you did, consider going to your Google Account permissions and removing any permissions given to “Google Docs.” You’ll find the permissions lists here.

UPDATE: Google says it has “addressed” the phishing email that was posing as a Google Docs share and has provided additional info, as well as their security checkup to help keep your account safe, should you have been duped.

Written by

Kellen

It’s not often that you get to merge personal passions into a professional life, but that’s what Kellen did when he launched Droid Life in 2009. After working years of unsatisfying jobs in the medical and property management fields, he took a risk to try and create an online community while playing with the coolest gadgets on the planet each day, a risk that has turned out to be incredibly rewarding. Outside of Droid Life, Kellen is your typical Portlander who drinks way too much good beer, complains often about the Trail Blazers, and can be found out on the streets for a run, rain or shine.

Post navigation

33 Comments

  • Anyone else find it funny that the day Google releases increased Phishing tools to its gmail app, this happens??

  • I was one of those idiots who opened it. I work for a school system and it came from a colleague’s machine. I get shared Google Docs nearly every day, so it was nothing special to get another.

  • Got two of these today form various folks. Sent both users (in separate emails) a note to change their passwords asap.

    Changed mine as well for good measure.

    Oh, and Todd’s a dick.

    • As I understand it, this attack uses OAuth, and therefore bypasses password and even two-factor authentication. Changing your password doesn’t mitigate it — If you have given the attacker authorization to access your account, you have to login and explicitly revoke that authorization (https://myaccount.google.com/permissions).

  • “Be careful with this message” should be the first indicator…

  • This seems to also be getting sent to multiple colleges. I work for a public school system in IT so we’re on the watch for it, too.

        • Google is paying 97$ per hour! Work for few hours and have longer with friends & family! !mj155d:
          On tuesday I got a great new Land Rover Range Rover from having earned $8752 this last four weeks.. Its the most-financialy rewarding I’ve had.. It sounds unbelievable but you wont forgive yourself if you don’t check it
          !mj155d:
          ➽➽
          ➽➽;➽➽           http://GoogleFinancialJobsCash155MarketAppGetPay$97Hour… ★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★✫★★:::::!mj155d..,..

        • I began freelancing over net, through doing some fundamental work which exclusively requisite a personal computer and also access to broadband in addition to I am delightful than ever before… six months have passed by ever since i first began this furthermore i received earning full amount of of $36k… Normally I earn eighty bucks each one hour and even work for 3 to four hours nearly all the times.And fantastic thing about this is exactly that you can keep control of valuable time whenever you work and so for how long as you like and you acquire a take-home pay weekly. —->>>LEARN Extra Regarding It here-> http://olaurl.com/15cnq

          zsrbqwriavew

    • because they all aren’t as l33t as you, and of all the scams out there, this one is much, much more convincing than most.

      • Yeah most wouldn’t expect a harmless document be able to take over all of your sh!t

      • No. It’s not convincing at all. Only the gullible click on links they don’t know.

        • This. That looks HELLA suspicious! You’d think the phishers would use “administrator” or “mailmaster” or something less random than a bunch of Hs :-/

    • I’m at work. Even with warnings to never open an unexpected email, and to always double check the sender, I’ve had 7 people infect their machines. So yes. Absolutely no matter what precautions you take, there is always a handful of dumb dumbs on auto pilot that will click on that.

      • No one here did thankfully, last time someone did something stupid I gave them crap about it for weeks, every now and again I’ll ask if they opened anything from the nigerian prince recently.

    • History is filled with much worse scenarios that all started because humans do stupid sh1t. All. The. Time.

    • I work with teachers that call the 800 numbers that pop up on sketchy sites thinking that they’ll actually be reaching me and the rest of the IT department… So, yes, Doctor… People are that dumb. You’re Scottish this regeneration, so you should know that. LOL

Comments are closed.

back to top