Pretty Convincing Google Docs Phishing Scam is Making the Rounds, Google is Investigating (Updated)

You may have received an email today that looked a lot like an email you get when a colleague or contact shares with you a Google Docs file. If so, you should be careful and double check that it’s actually from that someone. I say that because a pretty convincing Google Docs phishing scam is making the rounds at the moment. 

Emails are showing up in inboxes (ours included) that look like the email images I’ve included in this post, from an email address of “hhhhhhhhhhhhhhhh@mailinator.com” along with a contact of yours. Pretty realistic, right? Should you actually click the “Open in Docs” button in the email, you’ll likely be asked to select a Google account before giving something called “Google Docs” a whole bunch of permissions or access to your selected Google account. That’s a bad thing and could lead to other very bad things.

As noted by this reddit user, who provides images of the entire process, you are basically giving someone full access to your Google account should you allow it. You are not actually accessing a Google Docs file because none were actually shared with you. Once you have given up access, your contacts are exposed and emailed the same scam, but you may also be vulnerable to someone having control over your account. Scary stuff, for sure.

Thankfully, Google is already on it and may have resolved the issue, according to someone claiming to be a Googler in that reddit thread I just linked to. I’m not sure what that means, but I’m hoping they will find the phishing scam and remove it from inboxes before it spreads further. If anything, we know that the official Gmail Twitter account has acknowledged the phishing email and warns users to avoid it. They are investigating it.

So, if you get any weird looking Google Docs requests today, be careful. If you did, consider going to your Google Account permissions and removing any permissions given to “Google Docs.” You’ll find the permissions lists here.

UPDATE: Google says it has “addressed” the phishing email that was posing as a Google Docs share and has provided additional info, as well as their security checkup to help keep your account safe, should you have been duped.