bell Warning! JavaScript is disabled! To take full advantage of our site and functionality, we recommend you enable it.
Online Threat Alerts (OTA)  - Alerting you to cyber threats lurking on the internet.

Google Docs Phishing Email Scam

Date: April 25, 2013 2:09 PM - Views: 98,411 - Article ID:4942 - Comments: 69
Google Docs Phishing Email Scam

Google account users, beware of the phishing email messages below that were designed to steal your Google user name and password. If you receive any email message appearing as if it came from a friend or family member, asking you to view a document that was uploaded to Google Docs or Google Drive, please delete this message. This is another malicious attempt by hackers and scammers to steal your Google account information so that they can rob you or sell your information to other scammers.

Here are copies of the "Google Docs or Google Drive Phishing Email" scams

Subject: VITAL NEWSLETTER

Hello,

I uploaded this vital newsletter using my google doc. For immediate access CLICK HERE

Sign in with your email.


Hello,
Please view the document i uploaded for you using Google docs, CLICK HERE and just sign in with your email to view the document its very important


 Subject: RE Important Document
Hello,
Here is the document i told you about,i sent it in a more secured way, CLICK HERE. and log in with your email for immediate access and more information.


Hello, Kindly click the link to view the document I uploaded for you using Google cloud drive. Just Sign in with your email to view the document, it is very important. Thank you, -- Rev. Dr. Karen Serving Humanity Spiritually

If you click on the link in the email message, you will be taken to the web page greensolutionsgp .com/google/google /index.php.htm.

This is how the phishing Google Docs page looks

Google Docs Phishing Email

Google Docs Phishing Email

It appears that the website greensolutionsgp.com was hacked and the malicious page "google/google/index.php.htm" was put there by the hackers.

You will be asked to sign in with your Google email address and password. If you enter your Google credentials on this page, it will be stolen by the hackers who have set this page up.

If you have already entered your Google user name and password on this bogus web page or others, please change your Google password right now!!!

There are different versions of this Google phishing scam, so please be on the look out for e-mail messages asking you to view documents in Google Docs or Google Drive.

View, submit comments and answer questions below. If you want to receive alert notifications, please click here to register.

Alert others by sharing this article with them.

Send this to someone via email:
Email address:
Like our Facebook page at: www.facebook.com/OnlineThreatAlerts
Follow us on Twitter at: www.twitter.com/onlinethreatale
Click the following thumb up or down, if you like or dislike this alert.
Rating: Thumb up 1 likes Rating: Thumb down 0 dislikes   

Tell us what you know or ask a question regarding this alert, by leaving a comment below. If you ask a question, please revisit to view the answers.If you have a question about something different from what this alert is about, do not post it below, instead, send that question to us using our contact us form. Click here to contact us.

Read the comments below, if there are any, before posting your comment or question. Someone may have already answered your question. Duplicate questions or answers will be deleted.


Your comment should not consist of all capital letters because it denotes shouting and shouting at other users is not acceptable.

If you want to receive email notifications when someone makes a comment, asks or answers a question, please click here to register. Anonymous users do not receive email notifications.

Comments or Questions (69)

The comments on this page do not necessarily reflect the views of Online Threat Alerts. Online Threat Alerts reserves the right not to publish comments that may be deemed libelous, derogatory or indecent.

  • dtaylor: 14 hours, 46 minutes ago

    Someone set up a Google Apps account and somehow connected it to my gmail account a got access all of my contacts and past emails. Then they added an alphabetical letter to the middle of my business email address (which they must have gotten from my past emails) and sent out emails to all of my gmail contacts with this fake email address that has one extra letter in it. The fraudulent email contains a link to a supposedly google drive app and the email heading states "Follow-up Shared Doc!"

    Before doing this they sent a fraudulent email to my broker and asked them to wire money to two foreign bank accounts.

    Am I right to assume that they did not get access to my computer, only my gmail account? I have done a few scans and nothing turns up.

    Thank you.
    DT


    • info: 8 hours, 33 minutes ago

      Change your passwords immediately.


  • Anonymous: 4 days, 10 hours ago

    I was shocked to see a message sent by my email-id. How do they get access to ur email account? Are there any ways to stop them?


  • Anonymous: 5 days, 24 hours ago

    I have been sent these emails,never opened them because I was suspicious,now my contact list is being sent this email from me. How is that happening?


    • info: 5 days, 22 hours ago

      The emails probably are not being sent from your email account.

      Maybe the emails that the persons on your contact list are receiving, were sent from some other email account, but the sender spoofed his/her email address.

      Email spoofing allows someone to change the "From" address of an email message, to make it appears as if it came from someone else.

      Here is an example:
      I can send an email message to you, and change the "From" address to "president@whitehouse.gov". So, when you receive the email message it will appear as if it came from the Whitehouse, instead of me.

      But, if they are still sceptical, please change your email address password.


  • Anonymous: 2 weeks, 2 days ago


    The scam go to or points to: http://www.untouchedworlds .com/pay/Google_Doc/secure Login.htm

    Please kindly check the Document i sent you via Google Document.
    And get back to me.
    VIEW ORIGINAL DOCS HERE
    And log in with This email.
    It is very important.
    Regards.

    Ronald L Korf, CEO
    Korf Continental, Korf Auto Group | www.korfautogroup.com
    Ford Lincoln Chevrolet Buick GMC Chrysler Dodge Jeep Ram
    500 West 8th Avenue, Yuma, CO 80759
    (T 970-848-5361 | C 970-396-5275)
    rlk@korfauto.com ronkorf@outlook.com


  • Anonymous: 2 weeks, 5 days ago

    OK, so if I already clicked, etc., and already changed my email password, I should be ok, right?


    • info: 2 weeks, 5 days ago

      Yes, you should be ok.


  • Anonymous: 3 weeks, 3 days ago

    Here is another one of these scams:
    ---------

    "Just Uploaded Some Files For You Using Google Docs

    Kindly Click On Here To View The File I Upload For You.

    Best Regards."

    Link points to http://fullform.co .in/Hub/gdocs/index.htm


  • Anonymous: 1 month, 0 week ago

    I have received one of these emails and deleted it but i when I send it to my trash and then delete the trash it appears again. How do I remove it permanently.


  • Anonymous: 1 month, 1 week ago

    All my email contacts were deleted and the scam was sent to them. I have changed my password and secured my account but I get credit card bills, bank statements etc sent to my email account. Are they in danger? What should I be looking out for?


    • info: 1 month, 0 week ago

      Once you have changed your email address password, you should be ok.


  • Anonymous: 1 month, 3 weeks ago

    Noticed that my gmail security said: logged in from Dublin, CA with the following IP address: 108.200.178.199
    That was not legit!


  • Anonymous: 1 month, 3 weeks ago

    I have been receiving these and have contacted Google, and they advise me to click on the links and then click the "report abuse" link at the bottom of the page.

    That's right, Google support says to click on the links! I responded and say "do you really recommend that I click on links in a phishing email? If so, there is a problem with your system". They don't respond.

    Thanks Google


  • Anonymous: 1 month, 4 weeks ago

    Please note that the scammers/phishers will examine your gmail files and addressbook and forward the scam to all your contacts. Furthermore, they will examine your contacts and if they find a useful one, like the one to your broker or financial adviser, they will try to obtain money from your accounts, posing as you.


  • Anonymous: 2 months, 0 week ago

    I am usually pretty savvy to email scams, trojan horses, etc. but this one caught me off guard. After entering my email and password, I was sent to Google Template Gallery. I've not used this feature and there was nothing except the stock templates. At that point, I finally got suspicious and "Googled" the phrase in the incoming email. That brought me to this page and the awareness that I'd been "Phished". I immediately went back to my accounts and changed passwords.

    Thanks for being here and keeping watch.


  • Anonymous: 2 months, 1 week ago

    we are receiving messages such as : you have shared documets with (name).
    we are confused as we have not shared documents.. nor do we know who (name) is.


  • info: 2 months, 1 week ago

    From: Gmail Team
    Date: 12 February 2014 13:13:57 GMT
    Subject: Google Document

    You have a pending incoming docs shared with you via Google docs

    Click to open: eStatement.pdf

    Google Docs makes it easy to create, store and share online documents, spreadsheets and presentations.

    Google®
    ---------

    The link goes to phishing website: hxxp://cafesevda .com/google/index.htm


  • Anonymous: 2 months, 2 weeks ago

    Today I received the same. Thanks for information about it.I am pasting below the spam message from one of my friend.
    I sent you a document via Google drive, follow the link Click Here and just sign in with your email to view it.
    Thanks


  • Anonymous: 2 months, 3 weeks ago

    Just got this email from someone I know, there were email addresses in the distribution list that could have come from their computers, including my email address. I sent a 'reply all' with a warning not to open it and a link to this blog.


  • Anonymous: 2 months, 3 weeks ago

    Hi received a similar email from a previous employer:

    ----------
    Hello,

    I've uploaded an attachments to a Google Drive in a secure way to view a document CLICK HERE to view, its very important.

    Thanks.
    --------

    Link points to hxxp://www.espezia .com.ar/bin/gdocs/index.htm

    I was suspicious so I forwarded the email directly to my previous employer to have them confirm the email was legit and seconds after I got an email from them saying it was alright to open it.

    Looks like the account is hacked and they can even respond to email!!! Beware!!!


  • Anonymous: 2 months, 3 weeks ago

    Phishing scams are everywhere. If you happen to click on a link from a suspicious e-mail, always check the URL in your address bar. An e-mail from google should send you to a URL that contains "google.com" That is their domain and everything pertinent to your privacy should go through that. Everything else should be completely disregarded. This is the same for any large, reputable company. Beware of this for banking too, which is a very popular place for phishing scams!


    • Anonymous: 1 month, 2 weeks ago

      Google.com proves nothing. It just means that the phisher got a google address too.


  • Anonymous: 2 months, 4 weeks ago

    Well, I couldn't find a place on Google to report this email. Google needs to make it easier for people to quickly report stuff and then send out alerts to users. My bank has an email address that starts with spoof.bankname_url@... to quickly forward this crap to their security dept.


  • Anonymous: 2 months, 4 weeks ago

    This is pretty amusing to watch; someone in my school has a compromised account and sent it to every person in the school. Since then, numerous accounts have been compromised as well, with more emails sent. I am just facepalming at how gullible my co-students are. As an avid internet user, I know all about phishing and related methods, so I'm wondering how people don't notice the obvious signs.


  • Anonymous: 2 months, 4 weeks ago

    We have 3 gmail accounts hacked by the google docs scam. I have reset passwords, but cannot reopen my gmail. All pertinent communications are lost!


  • Anonymous: 3 months, 0 week ago

    Received email from GOOGLESECURITYALERTS@gmailteam .on,I roost .com

    Stating my email acct and password were recently used on another computer, mobile device or other location. Then it has a line to click on to verify.
    Question. Is this legit, who used my acct, or should I immediately delete.

    Thanks


    • info: 2 months, 1 week ago

      The email message that you have received is a phishing scam.


    • info: 3 months, 0 week ago

      Can you please send the email message to us. Our contact information is located on the "Contact Us" page.


  • Anonymous: 3 months, 2 weeks ago

    I received this e-mail, but I did not open because I suspected it was a scam. But the hacker used my yahoo user name. What is really worry is that these people are sending the same message to all my contacts.


  • Anonymous: 3 months, 2 weeks ago

    Strangely I've received two of these emails and when I replied to ask if it was genuinely sent from the user I received the reply:
    "Yes log on to see the document.

    Thanks".

    Even with this reply I didn't risk opening them since the people sending the request were not close acquaintances.


  • Anonymous: 3 months, 3 weeks ago

    Just received:

    "Hi,

    Please view this Document I uploaded for you using Google Doc.
    Click Here and sign in your email to see the important document Secured Verified Page.

    Thanks."

    From: Jermal Alleyne


  • Anonymous: 4 months, 0 week ago

    I received a slightly modified version of the email today from a business acquaintance's Hotmail account. The "Click here" text linked to this Chinese company's website: hxxp://ez-agogo .com/documented

    Subject: Document

    "Please view the document i uploaded for you using Google docs.

    Click here just sign in with your email to view the document its very important.

    Thank you"


  • Anonymous: 4 months, 2 weeks ago

    Mine came from:

    hxxp://adtechdirect .com/googleattachmentshared doument/


  • Anonymous: 4 months, 2 weeks ago

    Just got this one. Here is where it takes you to:
    hxxp://gmasti .net/ncdoc
    then redirects you to hxxp://www.himalayanrock .com/images/nrb.jpg


  • Anonymous: 4 months, 2 weeks ago

    New phishing email address
    hxxp://www.para-fiestas .com/js/slideshow/googledcmnt/index.html
    Pretending to be google drive. Worded exactly as described above


  • Anonymous: 4 months, 3 weeks ago

    I received an email today saying i have to upgrade my gmail account now for security reasons it asked me to reply with email address password d.o.b country or territory and alternate email and password. It said if i dont respond in 24 hours my account will be suspended if i dont do it within 2 week it would be deleted. they were doing it to find out which accounts were active or not


  • Anonymous: 4 months, 3 weeks ago

    Very helpful!!!!!


  • Anonymous: 4 months, 4 weeks ago

    Hi.. I received such a message and it looked so real.. It was not until I clicked on the steps and got nowhere that I thought it might not be real. Then I hit reply and found that it was her old address (which did not show up). I did change my passwords that I had put in.. Is there anything else I can do?


  • Anonymous: 5 months, 1 week ago

    I just fell for this. I entered my email and password. I will change the password now. Will that be enough though?


  • Anonymous: 5 months, 2 weeks ago

    Received such an email from helengatenby(at)gmail.com to my private email address. I do not know this person.


  • info: 5 months, 3 weeks ago

    The "Dear Gmail.com Email Owner" message below is another Gmail phishing scam. Click here to read about it.


  • Anonymous: 5 months, 3 weeks ago

    Is the following a scam or genuine?


    Dear Gmail.com Email Owner,

    We are upgrading our Email system to enable us reduce the occurrence of Spam. You are to click on the Link below to Upgrade your Email.

    hxxp://www.byfocal .com/forms/forms/form1.html

    Signed
    IT Service!
    System Administrator ®


  • info: 5 months, 3 weeks ago

    Opening the email will not affect you. The only way you will be affected, is if you enter your username and password on the phishing or fake website.


  • Anonymous: 5 months, 3 weeks ago

    i opened this email. it looked really genuine and it even said who it was from, someone I knew, but it didn't sound like their style of email. Because I opened this email, will it send a copy to all my contacts?


  • info: 6 months, 0 week ago

    Changing your password is the only thing than you can do. Ensure that you use a very strong password. A password that is not easily guessed.


  • Anonymous: 6 months, 0 week ago

    Ok so what do you do if you did click on the link and enter your info? I got it from a client and in haste I opened it. It's a little different than the one shown above but it's definitely a phishing thing. It sent an email to all my contacts. I changed my password but what else do I need to do now??? Help!


  • info: 6 months, 0 week ago

    Opening the email will not do anything to your computer. Entering your username and password on the fake website after clicking on the link in the email message is a problem.


  • Anonymous: 6 months, 0 week ago

    I opened the e-mail but did not click on the link. This should not be a problem right?


  • Anonymous: 6 months, 1 week ago

    Thank you for this. I received an email from someone I don't even know and it made me suspicious. It all looks very authentic but I still felt something wasn't right especially when it asked me to input my email and password so I did a quick search and sure enough this article came up and confirmed my suspicions. It's pretty scary because a few years ago I was more naiive and might have fallen for it. Thankfully back then these sorts of things weren't as prevalent as they are now but there are many other people who would fall victim to it including possibly the person who sent it to me because they are a real person. I google searched them and found their Facebook, website, a newspaper article and their linked in page.


  • info: 6 months, 4 weeks ago

    Yes, you should be safe if change your password. Please check to ensure that your alternate email addresses are correct. If the scammers change the alternate email to theirs, they will be able to reset your password.


  • Anonymous: 6 months, 4 weeks ago

    Please, i am so worry about this. I'm safe as long as I change my email password. I changed it inmmediatly


  • Anonymous: 7 months, 0 week ago

    I have a mac and I saw this come into my email so I did not open it up but I did send it to trash. Then my laptops curser started to jump around and it would fly between the one window i was on and the weather and time one Mac have. I had not control so I shut it down and did a full startup and reboot. Then I went into utilities to repair. I also deleted my trash my google trash and mac trash. I think I am good. BUT just after this happened my home phone rang and it was a recording telling me it was Allegacy Fed. Credit Union, and that I needed to call 866 872 3684 as soon as possible. So I got my Mac clean and started to do some digging. So it can happen to Mac and
    windows I am sure. I am worried because my old HP won't start up even when I go into safe mode, it acts like it wants to then reverts back to the Dos screen.
    But I think my Mac is good.


  • info: 7 months, 1 week ago

    You only need to change the password of the user names that you have entered. If you didnt enter the username and password on the phishing website for your other accounts, there is no need to change their passwords.


  • Anonymous: 7 months, 1 week ago

    Just to clarify - I'm safe as long as I change my email password. No need to change other passwords correct?


  • Anonymous: 7 months, 2 weeks ago

    The real risk with this scam is for people who, (like myself), are stupid enough to enter the username and password to their Google or Gmail accounts. There's a very, very serious risk for people who use services like "GOOGLE WALLET", which is an online payment service, just like PayPal that you use access and use using your Google account details.
    I am a user of Goggle Wallet, but I was lucky not to have signed in to their fake sign in page with that particular account information. All they got from me was access to all of my contacts, who they sent the hoax message to and no doubt they'll have collected a few new suckers from my list of contacts. I sent EVERYONE in my address book an email warning them to change their password IMMEDIATELY if they inadvertently gave out their information.


  • Anonymous: 7 months, 3 weeks ago

    New website doing the same thing. Here is the email I got...

    From: Google Team (googleteams @usa.com) Microsoft SmartScreen classified this message as junk.
    Sent: Fri 9/13/13 4:38 PM
    To: XXXXXXXXXX
    Microsoft SmartScreen marked this message as junk and we'll delete it after ten days.

    You have a secured document sent to you by me at Google Docs.

    To have access to the document please login with your e-mail address by following the link below.

    Read now >>> hxxp://www.itweakly .com/google/doc/drive/index.htm

    Each Document is Independently Owned and Operated by Sender of this message.
    Google Drive.
    ©2013 Google Incorp. All Rights Reserved.


  • info: 8 months, 1 week ago

    Although it may appear as if the email was sent from your account, it was not. The cybercriminals behind these scams use a technique called Email Spoofing. Click here to read about this technique.


  • Anonymous: 8 months, 1 week ago

    so if you were the one who's email account sent it, do you have to do anything?


  • Anonymous: 8 months, 2 weeks ago

    Please convey this info to mail.yahoo.com and hotmail.com as i have received mails in this both accounts. Saying:

    ---
    Receipant name,

    I have send you a document click here and get the documents.
    ---


  • Anonymous: 8 months, 2 weeks ago

    I have received two mails from hxxp://monquathuvi.com/googledocs/index.htm


  • Anonymous: 9 months, 2 weeks ago

    I just received a very similar email directing me to this phishing site:
    hxxp://k-webshop.com/sale/gogdocs1/index.htm


  • Anonymous: 9 months, 2 weeks ago

    Anything needed beyond change of pasword


  • info: 9 months, 3 weeks ago

    Maybe cybercriminals were able to gain access to your account by tricking you into entering your account user name and password on a phishing or fake website.

    With access to your account, they may have accessed your contacts' names and email addresses.

    I recommend that you change your email password.


  • Anonymous: 9 months, 3 weeks ago

    I understand the email spoofing part of the scam, what I don't get is how they target contacts in your address book? If it's pure spoofing, where do they get my contacts? I have run virus scan, nothing found.


  • Anonymous: 9 months, 4 weeks ago

    Hi I have just received email today gmail will stop if I don't re register to get rid if dormant accounts
    Al*b@gmail.com I have not replied


  • Anonymous: 10 months, 0 week ago

    So, can I fix it with only changing my passwords?
    Thank you!


  • info: 10 months, 3 weeks ago

    Although the email appeared as if came from your wife's email account, it was not. Scammers use a technique called email spoofing, where they alter an email message to make it appear as if it came from someone else.


    I could use this technique to send an email to you from my email address and change the "From" address to make the email appear as if it came from the "president@whitehouse.gov".


    Currently, it is virtually impossible to stop these scammers from sending these emails to you.


    Click here to read more about email spoofing.


  • Anonymous: 10 months, 3 weeks ago

    Good day, I got the email but it was coming from my wife's email account. She said she sent no such email so i guess she got one of those viruses that use your email to spam all their contacts.

    I would like to fix this but not sure what to look for or even how to start.

    Is this a worm/virus, if so how do I get rid of it / stop her account from spamming all her contacts.


About us   Advertise with us   Contribute to OTA   Report Cyber Threats    Mobile websiteMobile Website   RSS FeedRSS Feed   Contact us   Privacy Policy   Terms and Conditions   This site uses cookies to offer you a complete experience. Learn more.   Copyright © 2012 - 2014 Online Threat Alerts (OTA).