Google Drive Scam Steals Login Credentials

It cannot be said too many times. If you receive a link or attachment from someone you don’t know, don’t click it. It doesn’t matter if it comes in email or via the Cloud. A current campaign is going around attempting to get Google Drive users to click a link to a document that phishes for Google credentials.

The page that appears if the link is clicked looks like the actual Google login page. There is no malware included. It simply collects the information that is entered into the page; login and password details. What makes it difficult to tell if it is the real page is that it even uses Google’s SSL certificate, which thwarts any effort by security software to warn the user of risk.

Also, because Google’s own products are being used to distribute the link, any emails or other attempts to get the message out are difficult to detect as scams. Users may think that the message truly is coming from Google and may not have any reason to second guess the sender. But do it anyway.

Again, it bears repeating. If you don’t know the sender, don’t click the link. If you can’t decide if it’s a legitimate link, contact the sender independently of any messages and ask about it. This means email them separately (do not reply to the message) or place a phone call.

A bigger risk of this particular issue is that Google uses a single login for several of its services. So users of Gmail can also access photos, maps, calendars, documents, etc. with the single set of credentials. This puts even more information at risk should that get captured by hackers.

There are some items to look for to help determine if the Google sign in page is actually the correct one. The real one says “One account. All of Google.” The fake one says “Google Drive. One Storage.” In addition, on the fake page there is a link where you can create an account which just reloads the same page over and over. The hackers also don’t validate the password entered, so no matter what you put into that particular field, it will still work.

Google is aware of the issue and it is assumed the company will correct it. However, at time of writing the scam is still active.