Gmail Users Targeted in Phishing Attack
A phishing attack, that has been confirmed by Inc. to be in existence for over a year, is gaining awareness. Gmail users are being targeted by hackers, infiltrating their inboxes. Once the cyber criminals gain access to a persons email account, they have the ability to review all recent incoming and outgoing messages. This isn’t surprising. What is alarming is what they’re doing with it. Once the hackers find an email with an attachment, they will remove the legitimate attachment and replace it with a malicious Gmail login screen.
From there, they will send the malicious email, or phishing attack, to the person who received the original legitimate message. Since this person is familiar with the original email, the likelihood of them opening the malicious attachment increases significantly. Once they open it, a Gmail login screen will pop up, which they will input their email address and password. From there, the hackers have a whole new inbox to review and spread infections from.
Example
So lets break this down into an example. Joe sends Sara a Word document, from his Gmail account to hers. Sara’s account gets hacked. Cyber criminals see this email, replace the Word document with the malicious Gmail login screen, and send it to Joe saying something like “I made some edits to the report, see attachment below.”. Joe clicks on the attachment and then is prompted to log into his Gmail account. He does so, believing it will open the document. Instead, it just provided the hackers with the password to his email account. Now they can access his email and continue to do the same to others.
Phishing Attacks
A phishing attack is when hackers send out emails that include malicious links, attachments, even malware that infects upon opening the email. Phishing attacks are not a new concept, but they are continuing to evolve.
For example, this Gmail attack. The red flags typically associated with phishing attacks may not be caught because it is coming from an email string that you already know is legitimate. For instance, many times when a phishing attack takes place, you may not know the sender–with this attack, you do. Or you may receive an “urgent” email regarding an attachment that must be opened right away (incorrect invoice, tracking information, unpaid statement, etc.)–with this attack, you’re providing the hacker with an attachment you trust! Also, typically there are grammar and spelling errors within these emails–again, this attack is coming from a string of emails that you already know were safe, if you spot a typo it is likely you’ll chalk it up to human error.
