The malicious application will then copy the victim’s contact list and send a duplicate of itself to all the names in the list. However, giving permissions to this application will allow the scam’s perpetrators access to the user’s inbox and contact list, providing them the ability to read and send emails. The page will then prompt the user to choose an account and will also request permissions for an application with the misleading “Google Docs” name.

This email contains a link to the real Google account authentication webpage, complete with a list of accounts owned by the user. The initial email arrives on a user’s Gmail account from a known contact who wants to share a document. The scam is highly effective due to its perpetrator’s use of a third party application which is cleverly disguised as the Google Docs app-making it more difficult to detect than typical phishing scams. Users who have received a legitimate-looking Google Docs link in their Gmail accounts may be potential victims of a sophisticated phishing attack that has been making the rounds recently.

Google drive spam files