Early this afternoon, a new type of phishing attack popped up, targeting Google Docs/Gmail users and spreading like crazy. Well-disguised and infuriatingly subtle, just a click or two (on what was an actual Google-hosted URL, no less) handed some mystery attacker the ability to read your Gmail and forwarded the phishing attack to everyone you’d ever emailed.
The attack was simple, but sinister. You receive an email. It’s from someone who has emailed you before, and happened to have you in their contacts. They were “sharing a document” with you. Click the button to open the document, and you’d see a seemingly innocent page — one hosted by Google, no less! It wouldn’t ask you for a password, and it already listed all of your accounts. The page was asking you to give a “Google Docs” app permission to read your email and contacts.
The trick: That “Google Docs” app wasn’t actually Google Docs at all, just one somehow masquerading under the name.
Even if you were generally dubious of these sorts of things, it checked a lot of the right boxes. But click “allow” and bam — the mystery attacker now had inbox access and was fwd’ing the bait to everyone in your contact list.
Google says they’ve stopped the attack for now, and are “working to prevent this kind of spoofing from happening again.”
Here’s their full statement, via the Google Docs Twitter account:
Disrupt 2026: The tech ecosystem, all in one room
Your next round. Your next hire. Your next breakout opportunity. Find it at TechCrunch Disrupt 2026, where 10,000+ founders, investors, and tech leaders gather for three days of 250+ tactical sessions, powerful introductions, and market-defining innovation. Register now to save up to $400.
Save up to $300 or 30% to TechCrunch Founder Summit
1,000+ founders and investors come together at TechCrunch Founder Summit 2026 for a full day focused on growth, execution, and real-world scaling. Learn from founders and investors who have shaped the industry. Connect with peers navigating similar growth stages. Walk away with tactics you can apply immediately
Offer ends March 13.
(1 of 3) Official Google Statement on Phishing Email: We have taken action to protect users against an email impersonating Google Docs…
— Google Docs (@googledocs) May 3, 2017
(2 of 3) & have disabled offending accounts. We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team…
— Google Docs (@googledocs) May 3, 2017
(3 of 3) is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail.
— Google Docs (@googledocs) May 3, 2017
In other words, this specific attack is stopped… but now that the example has been set, copycats could potentially follow suit. Google is working on blocking the overall concept… but in the meantime, I’d still suggest being super wary of unsolicited/unexpected Google Doc shares.
