We originally published this blog on our DataBits News site in early 2014, but as it appears to be making the rounds again we want to make sure everyone has been forewarned. With sharing of documents becoming more and more common this phishing scam is trying to scam people on a platform many people are comfortable using and sharing information through on a daily basis. Like most phishing scams this one arrives via email with the subject of "Documents" "Invoice" or "Tracking Information". Naturally once you look at the body of the email it tells you to click on what looks like a Google Drive link to an important document. This is where it gets particularly scary, if you click on this link you are taken to a login page that looks exactly like every other Google login page you've ever seen. This "fake page is actually hosted on Google's servers and is served over SSL, making the page even more convincing," Nick Johnston of Symantec wrote in his blog. Johnston continued, "The scammers have simply created a folder inside a Google Drive account, marked it as public, loaded a file there, and then used Google Drive's preview feature to get a publicly-accessible URL to include in their messages." So it has a google.com URL, and it looks like a Google login. Unfortunately many people are likely to enter their login credentials without a second thought - and just like that their credentials will be compromised. What can you do to protect yourself? First is to stay alert. If an email comes to you with the subject of "Documents" or "Invoice" but you don't know the sender there is no reason to click that link. If an email comes to you with the subject of "Documents" or "Invoice" and you do know the sender think before opening it, would this person be sending me a document like this, even if they do send me docs do they ever just call them "documents" or "invoice"? Second you may notice that something is slightly off with how a login is happening, for instance in this case when you click the link it asks you to sign in to a Google account. Most Google users right now could type in gmail.com or drive.google.com and it won't ask for your credentials. Certain parts of Google, like the merchant login, always ask for you to...
