Gmail Worm Requiring You To Give It A Push And Apparently You All Are Really Helpful
Summary: A short-lived but widespread Google Drive-themed phishing campaign bcc'd targets on emails sent to a Mailinator throwaway inbox, with the sender spoofed as someone in the target's address book. The "Open in Docs" link led to a legitimate Google login page where a fake "Google Docs" service requested permission to read, send, delete, and manage email and contacts, then redirected victims to googledocs[.]g-cloud[.]win.
Key Takeaway: Cisco Cloudlock counted more than 275,000 OAuth applications connected to core cloud services like Office 365, up from 5,500 three years earlier - and Talos expects this OAuth consent trick to be copied almost immediately, with Facebook and LinkedIn as likely next targets.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026