If you saw a Google Docs email from someone you knew, you’d open it, right? And if, having clicked through, Google asked you to log in again, would you think something was wrong?

For countless Gmail users, the answer was no. Yesterday, a sophisticated phishing attack swept through the network, causing a ripple effect of compromised accounts. According to Google, the attack affected less than 0.1 percent of Gmail users, but that’s still as many as 1 million people. Hooking users with a phony Google Docs request, the application quickly asked for inbox permissions and then sprayed out as many email invitations as it could, spreading the attack even further. While the scheme can look simple, it was actually a string of linked spoofs, each…

Continue reading…