Head’s up! There’s a smart phishing scam making its rounds. The target, possibly you, receives an email claiming to be from a trusted vendor. The email reads: 
Once clicking “Open in Docs,” victims were asked to grant access to their account by a fake Google Docs app, which then hijacks the victim’s contacts and sends out identical phishing emails to replicate the attack. The clever scam is very deceiving as it actually comes through Google’s system. Most phishing scams try to steal personal information from victims by leading them to fake versions of real websites from an email. Google reacted quickly by shutting down the fake app and adding warnings to suspected phishing emails. What to do for prevention and repair:
- Tell your employees not to click on any Google Docs invitations they received on Wednesday, May 3, 2017.
- If they suspect their Google account may have been hacked: Tell your employees to go to https://myaccount.google.com/u/0/permissions to check what apps have authorized access. If they see a “Google Docs” app authorized on Wednesday they should remove it as well as any other apps they don’t recognize.
- Make sure you’re prepared and your employees are trained for additional phishing emails.
Google issued a number of statements detailing what happened and how it’s protecting users from such exploits explaining that fewer than 0.1% of Gmail users were affected. They were also able to stop the scam within approximately one hour. While phishing techniques are getting more sophisticated, there are lots of things users can do to avoid being phished. See more about techniques on our webpage www.stlcybersecurity.com and contact us to discuss options for training your employees to navigate these threats.