The company shut down the attack, which masked itself as a Google Doc invitation, within an hour.

The internet was a flurry Wednesday over a sophisticated phishing scam that was circulating around to Google users.

With the aim to steal access to users' accounts, the attack was masked as an invitation to open a Google Doc. Victims were asked to open a document, which would unknowingly grant permissions to their accounts. The scheme would then employ a technique called Open Authorization (OAuth) that used emails in a user's contact list to continue spreading itself. (Click here for CNET's full Google Doc phishing explained.)

In a statement on Friday, Google's Mark Risher said the company shut down the campaign within an hour. It removed the rogue app's fake pages and applications, updated user protection in Gmail and the Google Cloud Platform and "re-secured affected accounts." Risher noted that fewer than 0.1 percent of users were affected by the scam.

To avoid this situation in the future, Google is also updating how it will handle OAuth applications, its anti-spam systems and how it will deal with third-party apps that want to request user info.

Source:
courtesy of CNET

by Lynn La

If you have any stories or news that you would like to share with the global online community, please feel free to share it with us by contacting us directly at [email protected]