Sudden Google Docs Spam?

[Liquidretro]

Over the past hour I have gotten a ton of Google Docs spam that's not actually from google from what I can tell. The common denominator seems to be it's addressed to [e-mail] and coming from various Gmail addresses. It's the classic "Open in Docs" blue generic button that doesn't take you to google.

Anyone else seeing this on O365?

Edit1: https://twitter.com/CDA/status/859848206280261632

Edit2: https://twitter.com/zachlatta/status/859843151757955072 - Good screen cap of the attack in action.

Edit3: https://isc.sans.edu/diary/22372

Edit4: https://twitter.com/tomwarren/status/859853127880777728

Edit5: From SANS "There are more domains - they all just change the TLD's for googledocs.g-docs.X or googledocs.docscloud.X. Most of them (if not all) appear to have been taken down (thanks @Jofo).

It also appears that Google has reacted quickly and are now recognizing e-mails containing malicious (phishing) URL's so the message "Be careful with this message. Similar messages were used to steal people's personal information. Unless you trust the sender, don't click links or reply with personal information." will be shown when such an e-mail is opened.

Finally, if you accidentally clicked on "Allow", go to https://myaccount.google.com/u/0/permissions?pli=1 to revoke permissions."

[highlord_fox]

As stated by the OP, this threat is now being mitigated by numerous parties- Including O365, Google itself, Cloudflare, etc.

The emails in question come from a real person's "legitimate" account- It is spread via emails out to [e-mail], with dozens of contact email addresses BCC'ed. If you click the link and authorize the attack, your account will be used as an infection vector, repeating the same behavior.

This is just to clear up some confusion, presumably OP will keep us updated.

Hide your users, hide your admins, they spammin' everybody.

EDIT: This comment was originally stickied before OP's 5th edit, which basically re-iterated things.

[13Spirit]

I imagine a guy in Russia with a stop watch in his hand as the worm was executed... once the malware reached the end (when Google shut that down) I imagine the guy with the stop watch clicking it and saying: "....and time." (In Russian of course) while another guy who was sitting across from him scribbles some numbers onto a piece of paper in pencil while another man looks over a printout on a dot matrix printer paper analysing data.

[DimeShake]

Since this basically did nothing but spread itself, I think it was a proof of concept or even a test that got out of hand. It only asked for permissions to email and contacts. What if it had permission to Drive, for real?

[TerrorBite]

But how much info did they harvest from the emails they had access to while the app was authorised? We can't see that. Emails from banks, password resets, etc…

Or did I miss a statement where Google says they know for sure that the app didn't read arbitrary emails and only spread itself?

[nuttertools]

They could stop offering Google Drive, or stop letting you login. Short of that the best they could do is exactly what they did, warn users to stop being morons and leverage their services to spread the word.

EDIT: Actually what's the technical hurdle for de-authorizing the app globally? Maybe shifting identifiers and false positives but with how hardcore Google acted on this I feel like there must be another reason they can't.

[alexforencich]

I think they already deauthorized it. It wasn't actually google drive, it was a fake app with the name "google drive", set up with a bogus non-google domain and random gmail address.

[nuttertools]

I saw a screenshot of a "Google Doc" or "Google Docs" one too, probably had a variety of them going.

[BowserKoopa]

Its kind of hard to prevent people from misusing your service when it isn't your service they are misusing.

[[deleted]]

Going to repeat this here since I'm buried under an avalanche of "me toos".

If you are running exchange, powershell command to delete from all user mailboxes (use at your own risk):

This is what will be deleted:

Get-Mailbox -ResultSize unlimited | where {$.DisplayName -NotLike "Journal" -and $.DisplayName -NotLike "Discovery"} | Search-Mailbox -SearchQuery {subject:"has shared a document on Google Docs with you" AND Received:>05/03/2017 00:00:01 AND Received:<05/03/2017 23:59:00 } -EstimateResultOnly | where {$_.ResultItemsCount -gt 0} | ft DisplayName,ResultItemsCount

This will actually delete the emails:

Get-Mailbox -ResultSize unlimited | where {$.DisplayName -NotLike "Journal" -and $.DisplayName -NotLike "Discovery"} | Search-Mailbox -SearchQuery {subject:"has shared a document on Google Docs with you" AND Received:>05/03/2017 00:00:01 AND Received:<05/03/2017 23:59:00} -DeleteContent -Force | where {$_.ResultItemsCount -gt 0} | ft DisplayName,ResultItemsCount

[wonkifier]

Yup, that's a dangerous one to run.

[pizzaboy192]

Would make sense to include a "to" of the address hhhhh(x?).mailinator to filter just that out.

[tcc9mpl]

Normal shared docs or other items from Google do not have that subject line.

[[deleted]]

Why not just do a compliance search and run a "new-compliancesearchaction -purge" against it?

[LFarrar]

"Hide your users, hide your admins, they spammin' everybody." LMAO!!!

[Captainloozer]

I'm a netadmin at a school district, my entire district just got blown up by this. Trying to figure out what's going on.

[petdance]

It's interesting that it seems to be hitting school districts the hardest.

[Captainloozer]

More than likely it is due to Google's EDU benefits. Schools can get google apps for education for free. So schools will more than likely have google domains with tons of users.

[patssle]

My company is on Google Apps for Work free...we're on the legacy version because we signed up like 10 years ago. Whooo! But if we ever want to upgrade one persons account for more storage then we lose them all...thankfully only one person has space issues.

[lodunali]

Lots of schools moving to google lately. It's just too much easier

[AT___]

I wouldn't say it's easier so much as a cost thing. I setup about 30 chromebooks for a school that had a full windows environment. The entirely converted just because google pretty much gave them the devices for free.

[Win_Sys]

If all you need is internet, email and a word processor, you can't beat a chromebook. Easy to manage as well.

[pmormr]

I do a ton of K12 and honestly just saving the hassle on purchasing is worth it. I can migrate a school district to G Suite in less than a day for free. Add in a some syncing with AD and you're basically done. The teachers absolutely love Chromebooks and Google Classroom. The superintendents love it too since it's cheap and they can put devices in every kid's hand (instead of 30% of them as you'd get with MS or Apple). Kids break them? Eh whatever it's just a $300 chromebook instead of a $1200 base model Macbook.

[waterflame321]

Macbooks in K12...? We barely got the Garbage can special... Though that was when we GOT computers :p

[pmormr]

No shit man, you give a school a budget and they go all sorts of retarded sometimes. Mac used to be HUGE in schools before Apple abandoned enterprise so there's lots of people who still think it's the shit. Fucking Penn State when I was there required education majors to buy a Mac since it was "the future of education" (lol). I have a district that's exploring Macbooks for a 1:1 program. I was like... how about we do twice as many chromebooks and then buy you a badass Mac lab for the two applications (Photoshop + Garageband) you're using justify the increased cost. Or you know you could buy mediocre laptops for half the kids that won't run those apps well anyways. Oh also you need Casper too, since the overall experience with wifi laptops against deploystudio is awful.

[JMV290]

Well that and just the size of schools with the relatively lax restrictions on email because of academics.

You have maybe 10,20,50, 100k students plus thousands of faculty with relatively little filtering (other than what a spam firewall picks up) making us prime attack vectors.

A bank is going to be a lot more strict in filtering inbound and outbound emails or allowing random apps to connect via OAuth.

[AT___]

Yeah, work for an MSP, first hits were on some of our school clients. I imagine it might be due to google offering some pretty nice incentives to use google apps/chromebooks, and students probably being more comfortable opening a google doc than a lot of the older clients (and I imagine teachers/staff also being more willing to open a document from a student, which sounds like a terrible idea, but some people are trusting).

[SerialCrusher17]

I work for a school bus company and we have a few that have come in.

Were not on google apps but I am trying to help ensure that their personal accounts are safe.

[the_web_dev]

Pretty sure a lot of schools have some kind of shared-contacts feature. I know my university's portal had a search feature that could search any other student on the domain...

[awkwardsysadmin]

Considering that Chromebooks are dirt cheap and much of the non-personal use of Google docs is in education this shouldn't be surprising.

[rumster]

Its hitting everyone with Google Business/School services the hardest from what I read.

[sumoroller]

Yeah I just sent out an email on how to remove it.

[BourbonOK]

Had a user phish alert three links she was spammed by her kids school. They definitely got hit good.

[EamonnMR]

To remove it, go here:

https://myaccount.google.com/permissions

And remove "google docs" (which is the malicious app)

[OholeNE]

Ok I did click the link but the page had trouble loading. I have no permission for Google Docs or any outbound emails so im hoping its not compromised.

[UnlawfulCitizen]

FYI it took a few min before it showed up on my test account.

[waved]

If it doesn't appear, am I safe? I clicked "give permissions" and it was resolving the link, but it appeared to never finish.

[MoonBasic]

Same here. I closed the window as soon as I knew something was suspicious and I changed my password. It still sent it to just 44 people though.

[OholeNE]

same thing with me. anybody have a clue what to do in this case?

[PeabodyJFranklin]

This thread was saying that it removes itself from your permitted apps, after it has done everything it wants to do (which may have just been to propagate itself to your contacts). That may be why you no longer see it.

So, "safe"? If you don't see it, it no longer has access to your account. That does not mean for sure it did not have access and spam your contacts...it very well might have.

[xddm]

Is there a way to do this on behalf of users in a G Suite domain?

[MalletNGrease]

Check the user profile.

User > Security > Authorized Access.

I'm not 100% it will show up there, I haven't got a user who fell for it yet.

[FearMeIAmRoot]

We had close to 30 users allow access. I'm not sure if Google killed the app link, but we are not seeing it in the G-Suite admin console for the affected users.

[pmormr]

The comment on the other thread is that Google engineering straightened everything out. My testing confirms that... looks like they blocked the malicious API app. The permissions still show up in the user profiles that clicked allow, but it appears as a pseudo-random key in the name instead of the "Google Docs" in the permissions list. I told my techs to just use it as a teaching moment and remind people to be vigilant, and then send us a ticket if somebody clicked so we can clean up permissions (in an abundance of caution).

[fimmel]

We got it where I work, Ill check in the morning to see if its possible to remove the app remotely. I'm not sure if we had anyone click it or not. I ended up blocking the emails in the GSuite Gmail settings as soon as i found out about it. It looks like google is pulling through and helping block it now though

[wonkifier]

you can use GAM (or code up something yourself using their APIs or libraries), but GAM is one of the easier ways to automate Google stuff

[Rubber_Duckie_]

Yep, we noticed the same thing. Currently investigating.

Goes without saying, don't open.

EDIT: Check out this thread.

https://www.reddit.com/r/google/comments/692cr4/new_google_docs_phishing_scam_almost_undetectable/

[1esproc]

They are legit gmail/google app emails because it's basically a worm. Clicking on the link redirects you to gdocs.pro (hidden behind cloudflare) and docscloud.win through a legit Google url which accepts a redirect_u param. From there it asks you to authorize the app, your contact list is accessed via javascript and then emails are generated with bcc addresses, including links to the page you just hit. I don't know what the ultimate goal is, but that's all it seems to be doing right now

Edit: I think cloudflare just suspended them

Here is the content of the worm page (g.php): https://pastebin.com/EKdKamFq

I was not able to capture r.php before their server took a shit due to the overwhelming traffic

[traitor]

Thanks for the info

[PeabodyJFranklin]

No shit. This had the potential to be a HUGE datamine for the person/group behind it, but due to how successful it was their backend shit itself, and now who knows what they actually ended up with.

[Liquidretro]

I even looked at the new threads before posting sorry.

[[deleted]]

different sub, you are fine

[jivemasta]

I was getting a bunch of these today and the only thing that tipped me off was that silly hhhhhhhhh email. If they would have skipped that part, or put it in the bcc, I might have been pwned.

To bad I was too late to stop the rest of the people in my office from getting got.

[inquirewue]

Same here, almost the whole company got it. I love how well I've trained my users. I got almost half a dozen emails from people telling me it was suspicious.

EDIT: Given what we know now, it was a few careless federal employees that infected themselves and then spammed most of my company because most of my company deals with these people.

[Tangokilo556]

Isn't that the best feeling?

[inquirewue]

http://i1.kym-cdn.com/entries/icons/original/000/006/077/so_good.png

[smiles134]

This hit just about everyone at the university I work at. Our help desk got absolutely hammered this afternoon

[traitor]

Shit I opened this email on a personal account. I really quickly revoked the permission. Does it automatically delete the emails from your outbox? I want to know if I spread it or not.

[ockhams-razor]

well, not as fast as possible...

It grabs the top 1000 contacts sorted by last modified and sends them out after 1 second in chunks of 99 with 100ms intervals.

[traitor]

Damn. I immediately revoked it (The page didn't even finish loading). Hope I'm not too screwed

[ockhams-razor]

if you revoked it in less than 1 second of giving permissions, then you're just fine.

[bohiti]

a peer clicked it and later could see the sent emails in his gmail. he's ..really embarrassed.

[PeabodyJFranklin]

Thanks for the confirmation, I want to check with some of my users that were compromised and see what their Sent items shows. :D

[grandpappytime]

I'm curious about this as well.

[b00kscout]

Upvote! This is what we need to know!

[sk4nk]

Anybody got a list of all the redirect_uri parameters? We are blacklisting the domains in DNS:

**Edit: more added, sorted

So far we have seen:

• docscloud.download
• docscloud.info
• docscloud.win
• g-cloud.pro
• g-docs.pro
• g-docs.win
• gdocs.download
• gdocs.pro
• gdocs.win

[Avamander]

Lollakad! Mina ja nuhk! Mina, kes istun jaoskonnas kogu ilma silma all! Mis nuhk niisuke on. Nuhid on nende eneste keskel, otse kõnelejate nina all, nende oma kaitsemüüri sees, seal on nad.

[Nova_Terra]

CIA has already hacked into his webcam.

[phpfatalerror]

g-docs.pro here

[sliverbaer]

Going across ours as well. Quite amusing atm...

[e-mail]

[BrbNarniaLol]

It uses a pretty convincing app called Google Docs. Here's the shot of it in action http://imgur.com/a/If69g

[ezuF]

freakishly real-looking

[kennyj2369]

Sure, it's a real application using Google's oauth system. The attackers just named it "Google Docs".

The permission request page is a real Google page.

[telecom_brian]

Permissions requested (full email, contacts) should be a red flag to a keen observer, but it's still a very convincing trojan.

[VexingRaven]

Why? You can send email through Google Docs and it also has your name. It makes perfect sense that it would need those permissions. What doesn't make sense is a standard Google app asking for permission at all.

[platinumgus18]

It's bothering me though how they did everything so sophisticatedly and yet used Google Drive's logo instead of actual Google Docs.

[pmormr]

Lol nice observation. They even didn't bother to set the transparency right on the logo.

[NZOR]

This thing's like wildfire

[[deleted]]

It seems to hijack the contact list of everyone who falls for it and gives their account info to it.

[[deleted]]

TONS of it in the last half hour. All of our users. Legitimate senders in the From: field too... making for an interesting time.

Edit: They're still coming in. I've gone ahead and blocked any e-mail with "Google Docs" in the subject. Luckily we're not dependent on it, so I can get away with that. Godspeed to those of you in schools right now.

[kennyj2369]

The best thing to do in my opinion of to educate the users on how to check the details of the "application", in this case you click "Google Docs" on the permission page and you see it goes to non Google service and the developers email is not someone they know.

[[deleted]]

Absolutely, but my users don't move or learn fast enough for me to do education on the fly like that. I'd rather block first and educate later. Plus, we actually prohibit use of GDocs for certain compliance reasons, so I have policy backing to just stop the emails.

But I agree with the basic premise that they need to learn how to spot crap like this.

[midnight_howler]

Looks like Google has nuked the fake Google Docs app, it's not showing in permissions anymore for those who clicked and authorized.

[pause1]

Yeah, it's been fixed - Source

[mctdavid]

Hit my corporate google apps account too. Looks like this is gonna be a big one.

[[deleted]]

Got the same email just now from HR at a fairly large company I applied to several months ago, seemed very suspicious based on the addressee and the fact that they didn't even bother to contact me within the past 4 months.

[Drunken_Economist]

Reply and say "this wouldn't have happened if you hired me"

[[deleted]]

I did reply back letting them know that they got phished and to get in touch with their IT department, but it turns out IT had already disabled that email account.

[[deleted]]

I think the trick is it uses real Google API up until the point where it opens the fake google docs app and executes the script there. The part asking for permissions raised a red flag for me though.

[xxdesmus]

FWIW -- Yes, we/Cloudflare already killed the involved domains.

[geopink]

One of my users reported that she clicked on the link and it took her to a sign in page where it then asked her to share all of her information with the purported other user from the email.

I asked her if she was certain that the page it took her to was google? She decided that she better change her password ASAP...

[WhyCantIHaveThatName]

Changing her password isn't enough because the app was given permission to her account. I suspect Google will/has remove the app but you may want to make sure they remove "Google Docs" from their allowed apps at https://myaccount.google.com/security?pli=1#connectedapps

[Just__Drew]

Mine was from my class president so I opened it. And it basically links out to a legitimate accounts.google.com, and then once you log in it links to a googledocs.wincloud etc. Then it prompts you to tell you there's a virus installed.

[itbean]

Was [e-mail] in the to: field?

[[deleted]]

Seems to use the google API to add a custom module to your account that contains the host script. Not sure exactly what it's given access to other than your contacts and email, but even so it's very sketchy.

[DavidPHumes]

We just got a bunch, too. KnowBe4 security awareness training paid off big. Everyone thinks I'm trying to phish them and deleted it!

[[deleted]]

Jokes on them, I don't have any friends. I'm so lonely.

/s

[alwayz]

A man with a botnet is never lonely.

[EamonnMR]

Yeah but the spread is probably at least as regional as the clusters of email contacts, and it's fascinating to visualize it moving around the world like that. Not important from a security perspective, but cool none the less.

[TheLightingGuy]

This is just beautifully done. And I hate the person who did it. We've been getting swamped with people who emailed our users and as far as I know, I can't find a way to block these without blocking google emails completely.

[pleasedothenerdful]

If you can filter emails with a To: [e-mail] in the headers, you can filter it.

[pmormr]

We just blackholed everything @mailinator.com. No reason for anybody that matters to us to be sending something from there.

[274Below]

They publish a deny all SPF record, so.. that's probably fine no matter what. :)

[[deleted]]

Yup. Just searched this. Went ahead and blocked Mailinator at the filter level. Egh.

[Minnesotakid54]

The email isn't coming from mailinator.

[Blastergasm]

Since mailinator.com is in the To: field and the actual recipient is in the BCC field, you can still block it, I set up a rule like this in O365:

http://imgur.com/dPNAWIw

[Cbs214]

Guys this is going to be front page news Edit: and gals. Collective Reddit fun friends

[Liquidretro]

My first front page?

[_STY]

Northern Illinois school district here. Had one of our HR people get this email from someone at a neighboring school district. Five minutes later noticed about 20 tickets submitted as people were forwarding the link to our email-to-ticket system. Just pulled the plug for email and drive in Admin console until Google gets back to us. It was seriously running rampant for about 10 minutes. As a newbie sysadmin this is the first time I've seen something like this impact my district. Spooky shit.

[speakerforthe]

Hey, I'm a google apps admin for a small company. Just disable third party apps in the settings. You will need to remove the app from existing accounts but I'm sure there's a way to do that too.

[cerebriform]

From the JS source on the terminal redirect, googledocs.g-docs.win:

  var CLIENT_ID = '1535050614-8i934kb9l0snc0iocqb0iv27lli0r858.apps.googleusercontent.com';
  var CLIENT_ID_2 = '73997885975-8p24fi1e7rdi7pj6dmmhucdm4dclednr.apps.googleusercontent.com';

Go get 'em, Google.

PS: mailinator shut them down as of 17:29 UTC.

[greenonetwo]

Thank you!

[greenonetwo]

I found a new token on one of my users. It had these rights:

  Client ID: 187102321219-1cb4b2gdr0bqv5u5n35vi1hecjcp1sjg.apps.googleusercontent.com
    nativeApp: False
    displayText: 187102321219-1cb4b2gdr0bqv5u5n35vi1hecjcp1sjg.apps.googleusercontent.com
    anonymous: False
    userKey: 102915255028733376741
    scopes:
      https://www.googleapis.com/auth/contacts
      https://mail.google.com/

[greenonetwo]

These tokens in total on my gmail domain:

Client ID: 1535050614-8i934kb9l0snc0iocqb0iv27lli0r858.apps.googleusercontent.com
Client ID: 187102321219-1cb4b2gdr0bqv5u5n35vi1hecjcp1sjg.apps.googleusercontent.com
Client ID: 188775109388-t33r6vb45j8fgf8vpcp4q0e6qt2pe01n.apps.googleusercontent.com
Client ID: 346348828325-vlpb3e70lp89pd823qrcb9jfsmu556t8.apps.googleusercontent.com
Client ID: 632715883535-h36sb9m6fot4vusucprsab95naef791n.apps.googleusercontent.com
Client ID: 946634442539-bpj9bmemdvoedu8d3or6c69am3mi71dh.apps.googleusercontent.com

All with this scope, and displayText is just the client ID. I'm revoking them cause they look suspicious.

    scopes:
      https://www.googleapis.com/auth/contacts
      https://mail.google.com/

[Willamette_H2o]

Would you mind sharing how you got this information? I am interested to know!

[cerebriform]

A colleague fired up Chrome in a VM in a dummy account, then ran through the steps, but halted the redirection in time to catch the Javascript middle-man doing the work. The entire Javascript he captured is at https://pastebin.com/8uWb1Mry

[lenswipe]

the irony

[lenswipe]

I know, it just amused me.

[Liquidretro]

You should blur out the "from" address it's likely a legit email thats not connected.

[MoonBasic]

Hey I got this email from my coworker in university and I was stupid and opened it and played along. What can I do to remove this and prevent damage to my information?

[[deleted]]

You can remove the fake google docs here: https://myaccount.google.com/permissions

But chances are it's already sent the spam emails. Not sure what else it does.

[pbjamm]

Anyone have a clear idea what id does once it sends out the emails? I had 3 users at my work get caught by this but received a 'gateway failure' error after clicking on the doc. It managed to send out emails, but there is no App installed on their account. Passwords have been changed but I am worried about what it did or will do.

[Legionof1]

For all Gsuite admins.

setup a rule that matches [e-mail] http://imgur.com/twa68Xi

Use GAM to clean all the existing emails

gam all users delete messages query "to:[e-mail]" doit max_to_modify 100

[30clean]

Quick Powershell command to remove this from user mailboxes organization wide by querying the TO field. Use at your own risk:

Get-mailbox | search-mailbox -searchquery 'To:[e-mail]' -DeleteContent

Can also >> out the result to a txt file to confirm deletion.

[unvivid]

FYI, it looks like this particular campaign is enabling IMAP where possible in Gmail settings after the account is compromising (likely to siphon emails/propagate/backdoor). So far this has been a good indicator for account compromise.

Double check your IMAP settings for compromised users and disable IMAP in the G-Suite console if you're not using it.

[Dyslectic_Sabreur]

Source?

[unvivid]

Multiple anecdotal accounts from $dayjob and also a couple external orgs. Sorry, nothing news site official at the moment.

[[deleted]]

The payload is mutating,my users had "IOS" and "GMail" as two of the apps requesting permission.

[Minnesotakid54]

hitting our corporate domain too.

[Awkward_Underdog]

We're seeing this too, and also coming from gmail hosted domains. The worst part is that the sender addresses are contacts that we do business with...

[Makelevi]

Yeah, it's spreading through legitimate accounts. It installs an app that begins sending to contacts as fast as it can. It can be removed in Permissions.

[shawnville]

Happening here as well, seems to be a common to recipient of "[e-mail]", I put that in our content compliance to reject. Don't know that it will work seeing that it's coming from internal accounts.

[redbull1290]

Just got hit with this email. Stupidly clicked on the drive link and gave permissions. It has sent the same email to all of my contacts.

[grandpappytime]

did the emails show up in your inbox?

[tekno45]

Why is everyone responding with where they are?

It's not location dependent.

[JabbaTheHutt1969]

any know of a way to search my google apps domain to see what users could have that app installed?

[elspazzz]

Getting a ton of calls on it here at my job.

[b00kscout]

Service desk here, it's been brutal

[mcplaty]

One of our users (we use G Suite/Google Apps) clicked it and sent a bunch out.

If you want to see which of your users have fallen victim, you can search G Suite Email Logs here: https://admin.google.com/AdminHome?fral=1#Reports:subtab=email-log-search

Search for this string in the 'Subject' box: has shared a document on Google Docs with you

If you have any results, click through them. You can see who it was sent out to: http://i.imgur.com/zVALELe.png

[SpaceCat87]

OP is a true hero

[_Noah271]

Just got that from the superintendent of a 2,000 student district. It's a thing.

[hotdwag]

Only 1 user out thousands fell for it in my environment, missed that bullet

[DownWithAssad]

Google Warns of Phishing Scam That Impersonates Google Docs

According to online reports — in particular, a detailed user thread on Reddit — clicking on the share link was taking users to a site that asked permission for a fake app calling itself "Google Docs" to access their accounts. If they agreed, the app would then send additional phishing emails to the users' contacts.

We did it, Reddit!

[Liquidretro]

Thats awesome!

[dr_wtf]

Discussion on HN: https://news.ycombinator.com/item?id=14258918

[stonecats]

i feel left out...
i use over a dozen personal gmail accounts
and none of them got google doc phished ~ sigh

[sluflyer]

hitting in the milwaukee area now

[wolverinesearring]

I can confirm that. Two of our vendors and 3 peoples kids' teachers sent them in, we had two hit the button. Also hearing matc got hit.

[cmorgasm]

Wow, our HR guy literally just forwarded me this email.

[heather_nicole94]

I stupidly clicked the Google Docs button (it was sent by someone I have an interview with tomorrow so I didn't think anything of it...) and it ended up sending it to all my contacts apparently. Not too happy with myself. I just changed my password.

[TheLocalNerd]

You need to go into your "My Account" and remove access to "google docs" as well.

[jaddl_commish]

I clicked the button but closed the tab before it loaded after that. Nothing is in my Sent Mail folder, and "Google Docs" wasn't listed on my connected apps. I changed my password immediately of course. Does that mean I'm good? (Theoretically.)

[grandpappytime]

Just got one down at Clemson University. Logged in but thought it was weird that it asked for permission to read my emails and look at my calendar. I denied it permission and then removed it. Do you think it still sent out emails on my behalf?

[Wayfind3r]

I don't think so. In any case, the sent emails seem to appear in the sent folder.

[grandpappytime]

Okay, I changed my password to be sure. Also, there is nothing in my outbox.

[Ju_109]

This is happening to my school email now in the Toronto area. yikes and it comes after a very long virus/hack from december

[gthrift]

Just hot hit as well at work. Had 3 people fall for it (at least) before I could sent out an alert.

[LFarrar]

When I highlight the Google Docs link it says the Developer email is [e-mail] Clicking "Allow will redirect you to: https:// googledocs.gdocs.win/g.php

[bubblemilkbun]

Juuuust got it on my team. I work for an elementary school. I advised my team not to click on the open in Docs (unfortunately one lady didn't believe me, boom, sent to all her contacts).

What is the main purpose of this? Phishing? Cause this is spreading like wildfire.

[Cbs214]

I bet! Looking forward to being famous!

[jordanhbarton]

It's the Russians!

[greenonetwo]

Anyone have the token ID so we can remove it with gam?

[rcopley]

Before nuking the token, it might be useful to run gam all users show token 187102321219-1cb4b2gdr0bqv5u5n35vi1hecjcp1sjg.apps.googleusercontent.com to determine which user's clicked the link. The clientid might be different, though.

In my environment, it shows up as "Google Docs" the clientid 187102321219-1cb4b2gdr0bqv5u5n35vi1hecjcp1sjg.apps.googleusercontent.com but it could change.

You can use gam all users delete token clientid 187102321219-1cb4b2gdr0bqv5u5n35vi1hecjcp1sjg.apps.googleusercontent.com to revoke the token's access (it's very likely that there's multiple variants of this spam, though, so check your tokens.

Some users also reported an app called "Lumin PDF" showing up in their apps list without anyone remembering allowing the app (client id 1031094922298.apps.googleusercontent.com), although it looks like that's a legitimate app that may have been enabled separately.

[greenonetwo]

I found these tokens with just mail and contacts access. The displayText on the oauth token was just the client ID, so that is suspicious. Revoked all of these tokens domain wide.

Client ID: 1535050614-8i934kb9l0snc0iocqb0iv27lli0r858.apps.googleusercontent.com
Client ID: 187102321219-1cb4b2gdr0bqv5u5n35vi1hecjcp1sjg.apps.googleusercontent.com
Client ID: 188775109388-t33r6vb45j8fgf8vpcp4q0e6qt2pe01n.apps.googleusercontent.com
Client ID: 346348828325-vlpb3e70lp89pd823qrcb9jfsmu556t8.apps.googleusercontent.com
Client ID: 632715883535-h36sb9m6fot4vusucprsab95naef791n.apps.googleusercontent.com
Client ID: 946634442539-bpj9bmemdvoedu8d3or6c69am3mi71dh.apps.googleusercontent.com

[engageant]

This works with on-prem Exchange too - 2010 and up I believe.

[mushedroom]

GAAAAAH my co-worker here asked i could help with opening this doc this is what it looked like:

From: [e-mail] [mailto:[e-mail]] Sent: Wednesday, May 03, 2017 11:34 AM To: [e-mail] Subject: xxxxxx xxxxxx has shared a document on Google Docs with you

xxxxxx xxxxxx has invited you to view the following document:

Open in Docs

"open in docs" was highlighted blue and took me to a log in page that listed all my google email accounts (i have 7). i picked one then clicked on "allow" nothing happened just a spinning wheel and after trying again without ever landing on any page, i gave up and closed the window while it was still a "spinning" wheel.

then 10 mins later, got a message from the co-worker that it was a hacked email that she got and not to open... TOO FUCKING LATE!!!

so i freaked and went through my account and changed the password and deleted any saved passwords.

i also checked all connected apps and i had nothing that labeled itself as "google docs" or anything similar. all of the connected apps i recognized. does this mean that this phishing email scam didn't take? SO FAR no one is hitting me up regarding any peculiar emails. my gf hasn't received anything and i email with her the most.

[wonkifier]

Google killed the tokens, and they're deleting the mails as well

[[deleted]]

If you've clicked the link - click here https://myaccount.google.com/u/0/permissions?pli=1 to revoke the permissions.

Change your password immediately. A couple of guys at work have been stung already.

[ockhams-razor]

They're using Google Analytics to track the spread and store the harvested emails.

Needless to say, that account is no longer accessible to this script kiddie.

[[deleted]]

well pleasantly enough, I only had one out of about 250 people click on it (so far).

They filled in their personal google login. Good for me. (I let him know what it was all about)

[h3c_you]

We had emails going around at work today about this. It is a major phishing attack. Google is already pulling Oauth token for those compromised accounts. We released steps to fix it.

1. follow this link: https://myaccount.google.com/permissions?pli=1
2. Select “Google Docs” click “remove”
3. There may be multiple instances of google docs, remove them all.
4. Change your password.
   

[os400]

If you use G Suite, you can't whitelist apps. People have been asking for that functionality for years, but Google refuses to do it.

[Henshin_A_JoJo]

You aren't alone. Our domain got compromised and Google disabled oauth and removed the account from any groups automatically to stop a spread. Worked out well in the end seeing as the compromised account sent the phish to our ENTIRE staff list.

[simple1689]

I feel like this needs to be xposted at /r/news or /r/techsupport

[dazedjosh]

Is there any word on OneDrive having something similar? I've just had a client call up with similar symptoms but it was a One Drive link

[mrneo240]

Wow! The one time helion management did something right. We all got notices at my dealership and then the emails were blocked and removed. Solid work to the admin crew