Fwd: WARNING: New Google Phishing Scheme

[Jose Barreira]

---------- Forwarded message ----------
From: Jose Aragao <arag...@gmail.com>
Date: Wed, May 21, 2014 at 6:46 PM
Subject: Fwd: WARNING: New Google Phishing Scheme
To: Antonio A Ferreira <antonioaugu...@gmail.com>, António Gomes <antonio....@gmail.com>, Aurora Pinheiro <aurorapare...@gmail.com>, Carlos Carrazedo <carlos.c...@gmail.com>, CARLOS LOPES <62l...@gmail.com>, "cska...@gmail.com" <cska...@gmail.com>, Joao Aragao <j.ara...@gmail.com>, Joao Patricio <jota9...@gmail.com>, Jose Barreira <jb.nav...@gmail.com>, Jose Barreira <jbnavi...@gmail.com>, jose miguel <zemig...@gmail.com>, Lili <lili.t...@gmail.com>, Luis Ferreira <luisferr...@gmail.com>, "luisfidal...@gmail.com" <luisfidal...@gmail.com>, lurdes gonçalves <lurdes...@gmail.com>, meg-lisboa Margareth <megl...@gmail.com>, Miguel Aragao <miguel...@gmail.com>, Miguel Pereira <estor...@gmail.com>, Ricardo Germano <ricardo...@gmail.com>, Teresa Sousa <tegi....@gmail.com>, Vitor Estoril <VSPEED...@gmail.com>, Zenóbia Martins <zquadro...@gmail.com>

Data: 20/05/2014 13:12
Assunto: WARNING: New Google Phishing Scheme
Para:
Cc:

Information Services has learned Hackers are targeting Google users' passwords in a new, advanced, phishing scheme that is difficult to detect and block.  The scam starts with an email that claims to be from Google with the phrase "Mail Notice" or "Lookout Notice" as the subject.

The message in the email reads:

"This is a reminder that your email will be locked out in 24 hours, due to not being able to increase your email storage quota. Go to the INSTANT INCREASE to increase your Email storage automatically."

A link then redirects the user to a bogus Google login page where the user is prompted to enter their credentials.  Once the hackers receive the credentials, they have access to not only a victim's email, but to all Google documents, Google Play, and Google+. If the person uses the same login information for multiple sites, the hacker can access those too. 

This specific attack shows "Data:" in the Web browser instead of "HTTPS:" which indicates that the Google site is not a real one. While Chrome is most vulnerable to this particular attack, the Firefox browser is also affected.