google Gmail Users Under Attack As Hackers Develop Sophisticated Phishing Technique

[vissha]

Gmail Users Under Attack As Hackers Develop Sophisticated Phishing Technique

 

 

New phishing attack launched against Gmail users

 

Quote

A new wave of phishing attacks launched at Gmail users has been spotted online, but this time cybercriminals are using a more sophisticated technique that’s pretty difficult to spot at first glance.

 

Specifically, attackers are now sending emails to Gmail users with embedded attachments that look like images and which require just a click to launch what is supposed to be a preview of the picture.

 

Instead, the attachment opens a new tab in your browser that requires a re-login. When inspecting the typical elements that could point to a phishing scam, such as the address bar, everything looks legit, as in this case the URL is the following: “data:text/html,https://accounts/google.com.”

 

So naturally, most users would provide their Gmail credentials, but as WordFence reports, once you do that, the account is compromised.

 

Surprisingly, the hacked Gmail account is almost instantly accessed in order to retrieve the contacts and then uses the same phishing email to spread the attack. Using email addresses from a person’s contacts can make emails look even more legitimate, thus helping compromise a bigger number of accounts.

 

Most likely, the access is automatically performed by a bot, but there’s also a chance for attackers to do the whole thing manually in order to collect email addresses.

 

How to detect the phishing attack

 

The easiest way to determine that a message is a phishing attack or not is by looking in the address bar. As we’ve told you before, attackers were particularly focused on ways to make the URL look more legitimate, but in reality, there are a lot of white spaces that you can remove to check out the end of the address.

 

If you do that, you can notice that the URL ends with a script that’s supposed to launch the new tab and point the browser to the phishing page used to steal login credentials.

 

Google has already offered a response, according to the aforementioned source, but it’s not what you think, as the company doesn’t seem to be too keen on blocking the attacks.

 

“The address bar remains one of the few trusted UI components of the browsers and is the only one that can be relied upon as to what origin are the users currently visiting. If the users pay no attention to the address bar, phishing and spoofing attack are - obviously - trivial. Unfortunately that’s how the web works, and any fix that would to try to e.g. detect phishing pages based on their look would be easily bypassable in hundreds of ways. The data: URL part here is not that important as you could have a phishing on any http(s) page just as well,” the firm said.

 

The easiest way to keep your account secure, even if you fall for this phishing attack, is to enable two-factor authentication for Gmail, which means that in case you do provide your login credentials on the phishing website, the attacker shouldn’t be able to access your account anyway.

 

Source

Alternate Source - Don't Fall For This Dangerously Convincing Ongoing Phishing Attack

[knowledge-Spammer]

alduin

maybe this how things happned with u

[straycat19]

No matter how many articles are written and warnings relayed there are always going to be idiots with keyboards, who think because they can log in to a computer and run a few programs they know more than the computer security experts who are warning them, and will continue to do stupid things that I couldn't even teach my dog to do.  Which must mean my dog is smarter than most people with a keyboard.

[DKT27]

I think it's becoming common that such things are getting more expertised these days. I guess the rule to not clicking any links in the email nor opening / downloading anything in it is even more valid now I think.

[Lee]

You should already have 2-Step enabled to avoid this sort of technique:

 

https://www.google.com/landing/2step/

[46&2]

You should already have 2-Step enabled to avoid this sort of technique:

yeah then they'll have your phone number as well!
How about a 3-step verification where you also enter your SS# or drivers license # , get it yet?

[D1v1n3D]

why not fingerprint and face scan at the same time with voice recognition simultaneously.

[Lee]

7 hours ago, 46&2 said:

yeah then they'll have your phone number as well!
How about a 3-step verification where you also enter your SS# or drivers license # , get it yet?

 

How will they have your phone number? Sounds like you haven't used it.

[steven36]

I've not used a gmail or signed into google since 2011 so that hacking is gmail users problem not mine   i think any of them wants a phone number now  if you make a new email account  that's based in the USA .

Quote

Invacio have an established product called Invmail servicing this arena already https://www.invmail.io reportedly numerous financial houses and fund groups use the product as local installs or the cloud variation.

 

 

 

open beta

• 1 GB Secure Email Storage

• Two Factor Authentication

• Secure Contacts

• Additional 500 MB free forever

https://invmail.io/