Account hacking is no new phenomena, but the most recent phishing scam may be the most well-executed in recent history.
So, how does the scam work? The scammers target Gmail users who log in to their accounts through a web browser. The most common browser for this is Google Chrome, but it also affects Firefox and Internet Explorer users. Scammers send an email to the Gmail users disguised by an email in that person’s contact list. In the email is an embedded image that is almost identical to the popup that shows someone has an attachment. However, the ‘attachment’ is not an attachment. Instead, it is a link that prompts the user to log back into a page identical to the Google sign-in page.
Accordingly, most users re-enter their login information. The phishing page then sends all the login credentials to the hackers, allowing them to share the scam further. Afterward, the culprits use that person’s account to email out the link and further spread the scam.
Many people don’t realize the email is a scam because of how closely the attachment image and login page resembles Google’s.
Users need to pay attention to the URL of the login screen to tell the difference between the login pages and avoid the phishing scam. When a user clicks on the phishing image, the URL for the login page will begin with “data:text/htyml” instead of “https:” like the real Google page does. The “data” beginning of the URL indicates a user is no longer on a secure server.
Despite the phishing problem, Google officials are attempting to show users they are ahead of the game. The latest version of the Google Chrome web browser features a warning that alerts users when unsecured pages load. Fortunately, this prevents many people from falling victim to the scam and sharing it with other users.
In response to the issue, Aaron Stein from Google Communications said Google continually strengthens its defenses again scamming problems.
“We help protect users from phishing attacks in a variety of ways,” he explained. “Users can also activate two-step verification for additional account protection.”
The multiple protection Stein spoke of include: machine learning-based detection of phishing messages, safe browsing warnings that alert users of dangers links, suspicious account login prevention, and more. Those who do not use Google Chrome may not have the “Not Secure” warning.
