GMAIL phishing attack saga

imagensecforcepost.png

It all started a week ago. Some news hinted that some attackers were stealing domains taking advance of a Gmail vulnerability. Even when it was not confirmed, the story was Digged and generated quite a lot of buzz in the security community.

It all seemed that a new version of an old GMail hijack technique

On Tuesday Google confirmed that no known vulnerabilities were affecting Gmail and that the incidents were phishing attacks whereby attackers set up fake websites asking for Gmail username and password.

This is very interesting because it reinforces the theory that simple attacks targeting human security awareness are still very effective. At SECFORCE we work with our clients to increase security awareness and prevent this kind of attacks form happening.

You may also be interested in...

Unhooking-Technique.png
June 25, 2021

Whisper2Shout – Unhooking technique

This blog post is the first part of a series focused on malware detection evasion techniques on Windows. In particular, we look at userland API hooking techniques employed by various security products and ways to identify and bypass them.

See more
WMWare-blog-shell-escape
Feb. 18, 2022

Escaping VMware’s NSX Edge OS Jailed Shell

CLI injection vulnerability that was discovered during a penetration test against VMware Cloud Director.

See more