Gmail Phishing Scam – Your Account May Be At Risk!
If you are a regular web browser or know your way around the Internet, you probably know all about phishing scams.
For those who don’t, phishing is the attempt to obtain sensitive information such as usernames, passwords, and credit card details (and, indirectly, money), often for malicious reasons, by disguising a communication source as a trustworthy entity in an electronic communication.
Most phishing scams are very easy to detect and easily differentiated from any original website. However, Wordfence recently highlighted a scam that is devilishly clever and can easily dupe you, if you aren’t careful.
This scam works very simply, an attacker disguises themselves as someone you know and sends you an email with an attachment. When you click the attachment to get a preview, you will be redirected to the Gmail login page.
Here is the catch—the attachments you are clicking aren’t really attachments. They are embedded images to look like mail attachments, but they force you to go to a fake Google sign-in page.
See Tom Scott’s tweet for the image describing the situation.
The fake Google sign-in page looks absolutely perfect! The logo, colors, text boxes—everything is in place. But if you look more carefully, the address bar shows not your usual URL with a standard ‘https://’ but a data URL with the prefix ‘data:text/html’. Attackers get all the information you type in the fake website.
After the Chrome 56.0.2 update, Google made it easier to spot fake forms like these, but couldn’t stop them completely. Whether you use Chrome or any other browser be vigilant when opening any sorts of attachment. Always double check the address bar when putting your credentials
For those who don’t, phishing is the attempt to obtain sensitive information such as usernames, passwords, and credit card details (and, indirectly, money), often for malicious reasons, by disguising a communication source as a trustworthy entity in an electronic communication.
Most phishing scams are very easy to detect and easily differentiated from any original website. However, Wordfence recently highlighted a scam that is devilishly clever and can easily dupe you, if you aren’t careful.
This scam works very simply, an attacker disguises themselves as someone you know and sends you an email with an attachment. When you click the attachment to get a preview, you will be redirected to the Gmail login page.
Here is the catch—the attachments you are clicking aren’t really attachments. They are embedded images to look like mail attachments, but they force you to go to a fake Google sign-in page.
See Tom Scott’s tweet for the image describing the situation.
The fake Google sign-in page looks absolutely perfect! The logo, colors, text boxes—everything is in place. But if you look more carefully, the address bar shows not your usual URL with a standard ‘https://’ but a data URL with the prefix ‘data:text/html’. Attackers get all the information you type in the fake website.
After the Chrome 56.0.2 update, Google made it easier to spot fake forms like these, but couldn’t stop them completely. Whether you use Chrome or any other browser be vigilant when opening any sorts of attachment. Always double check the address bar when putting your credentials
