Google Warns Against New Phishing Attack on Gmail and YouTube Users

Background

Google has issued an alert to users of Gmail and YouTube against an emerging phishing attack that poses a threat to users of these online services. Hackers use this attack vector to harvest the personal and/or sensitive data of unsuspecting individuals to perpetuate other malicious activities.

Modus Operandi

Gmail Account Phishing Attack:

Attackers are impersonating Google’s brand to send fake emails or pop-ups beginning with the subject line “Online Reward Program”. Users who open this email or pop-up are presented with a message “Congratulations! You are a lucky Google user! “Every 10 millionth search is reached worldwide; we will proclaim a lucky user to send out a thank-you gift. You are the lucky user!”. The message then requires users to click on a specific link to redeem their prize by entering their personal information, which is then harvested.

YouTube Phishing Attack:

Attackers are impersonating YouTube channels to send fraudulent emails to unsuspecting users. The emails are sent from no-reply@youtube.com using subject lines such as "YouTube policy change" and "The YouTube team sent you a video." The email contains a link to the video or an attachment that leads to a fake login page where personal information is harvested or may contain malware.

Recommendation

  • Google does NOT offer spontaneous prizes in the format described above. Do NOT reply with your personal information.
  • Do NOT reply to or click on any link or attachment from an unsolicited sender.
  • Verify any reward programmes via mainstream media outlets such as newspapers and websites before assuming they are true.
  • Be cautious of messages that create a sense of urgency or fear, prompting you to take immediate action or risk losing access to your account or any other offer.

Contact the Cyber Security Authority

The CSA has a 24-hour Cybersecurity/Cybercrime Incident Reporting Points of Contact (PoC) for reporting cybercrimes and for seeking clarification and guidance on online links and transactions;Call or Text – 292, WhatsApp – 0501603111, Email – report@csa.gov.gh

Issued by Cyber Security Authority
May 8, 2023