Spotting Web-Based Email Attacks
Summary: Google warned that hackers were running targeted phishing attacks against hundreds of Gmail users, including senior U.S. government officials, Chinese political activists, military personnel and journalists, using stolen passwords to change victims' forwarding and delegation settings. The campaign used an HTML page mimicking Gmail's login screen that was custom-coded to prefill the target's username, and Google relied on the Contagio Malware Dump blog to reconstruct how the attacks took place.
Why it matters: The attackers did not need to steal a password to read mail - they changed forwarding and delegation settings, which most users have never checked, so the compromise can persist silently long after the phishing page is gone.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026