Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Google Docs or Drive Phishing Email Scams
Google Docs or Drive Phishing Email Scams

Google and other online email account users should beware of the phishing email messages or posts like the ones below that were created by cyber criminals to steal their accounts' usernames, passwords, infect their computers with a virus, ransomware or other malware. Recipients of unexpected email messages or posts appearing as if they came from a legitimate organization, friend or family member asking them to view a document that was uploaded to Google Docs or Google Drive, are asked to delete the messages or posts. And, should not follow the instructions in them.

This is simply because this is another malicious attempt by cybercriminals and scammers to steal the recipients' Google, Hotmail, Outlook, MSN, Yahoo and AOL account information, so that they can gain access to them. With access to their victims' accounts, cyber criminals will hijack and use them fraudulently.

Google users who have already been tricked by the phishing scam are asked to change their password immediately before their accounts are hijacked and used fraudulently or maliciously.

A List of Google Docs or Google Drive Phishing Email Scams

Subject: Important meeting tomorrow
From: ramya ramya (ramyaarose90@gmail.com)
Sent: Mon 7/25/16 4:17 PM

Attachments: Agenda for next meeting.html (6.5 KB)

HI ,

I’ve attached a Draft_Agenda.pdf for our emergency meeting tomorrow, Please view it and let me know if any changes/additions are required.

Thanks,

--Forwarded Message Attachment--

Login your email address below to view the document.

Email Address
Email Password

Passwords are case sensitive

Submit

To access our online secured documents page,you are required to login your email address.

Unauthorized Access is prohibited.

From: Brian Harris bharris2@sbcsc.k12.in.us
Date: Thursday, June 30, 2016
Subject: VIEW DOCUMENT

Hello

I've Shared a secure file Document attached with Google icon

CLICK DOCUMENT

Regards
Brian Harris
Private Group Communication Service
©2016 Google - Terms & Privacy

Subject: You have PDF docs to read

Please find attached document i uploaded through Google Doc Share Application.

for additional security Log in with your email account to view it.

View Document»

Important Doc.PDF

Memo.PDF

Payment info.PDF

View slide show (3)

Download all as zip

Regards,

Subject: 16102015_Proposal_ Letter.pdf16102015_ Proposal_Letter.pdf

Hello, Please find the attached for your attention. I tried to upload and send earlier but got an error message “The file you are trying to send exceeds the 25MB attachment limit” So i had to send it using Google Drive.

Open

Subject: IMPORTANT DOCS

Hello,

Please find newly attached documents, I have uploaded via Google drive Box Files Share Application.

VIEW DOCUMENT

Regards

Subject: Important files

i tried sending you a document yesterday, but i am not sure you received it, i just attached it again for your review and comments. It is password protected, so you must sign in with your email address e-mail to view the files

Subject: Please relate to the document
I have tried to send you this documents but I don't know why it's not going through. It may be due to large file attached. I decided to send it via secured
Google Doc
CLICK HERE

Subject: Rick Mitchell shared "important/update.pdf" with you via Google Drive
Rick Mitchell used Google Drive to share a file with you!

Subject: document

I have shared a file with you via Google Docs App.

Find it below for your quick review and perusal.

Click DOWNLOAD (http://investor-webcast.com/E-Drive4Google--KM12/) to view shared document.

Google Docs

Welcome to Google Docs. Upload and Share Your Documents Securely Sign in with your email address to view or download attachment Access your documents secure...

View on investor-webcast.com

Preview by Yahoo

Regards,

Subject: VITAL NEWSLETTER

Hello,

I uploaded this vital newsletter using my google doc. For immediate access CLICK HERE

Sign in with your email.

Hello,
Please view the document i uploaded for you using Google docs, CLICK HERE and just sign in with your email to view the document its very important

Subject: RE Important Document
Hello,
Here is the document i told you about,i sent it in a more secured way, CLICK HERE. and log in with your email for immediate access and more information.

Hello, Kindly click the link to view the document I uploaded for you using Google cloud drive. Just Sign in with your email to view the document, it is very important. Thank you, -- Rev. Dr. Karen Serving Humanity Spiritually

Subject: Document
Incoming Google drive document awaiting you

Please refer to the document I've shared with you using Google Drive App.

CLICK HERE TO VIEW THE SHARED DOCUMENT

Recipients who have clicked on the link in the email message or post, will be taken to the following malicious web pages and ask to sign-in with their Google or other email accounts credentials:

  • http://greensolutionsgp.com/ google/google /index.php.htm
  • http://primakoncepts.com/ docc/googledrive/contactform.php

Note: cyber-criminals will use other website names, so look out for this same scam on other websites.

Fake Google Docs or Drive Login Pages

Google Docs Phishing Email

Google Docs Phishing Email

It appears that the website: greensolutionsgp.com was hacked and the malicious page "google/google/index.php.htm" was put there by the hackers to ask their potential victims to sign in with their Google email address and password. But, if potential victims enter their Google credentials on the fake Google page, it will be sent to the cybercriminals behind the scam.

Again, recipients of the same phishing scam who have already entered their Google username and password on the bogus web page that they were taken to, are asked to change their Google password immediately! There are different versions of the Google Docs or Drive phishing scam, so please be on the lookout for e-mail messages or posts asking to view documents in Google Docs or Google Drive.

221

Comment sectionComments / Answers (221)

Remove sensitive information from your post. Your IP address will be used to display your estimated location.

Comment count 221

by an anonymous user from: London, England, United Kingdom

Got one today from a company I have only SEARCHED FOR! And that is not even in my address book. Worrying!

Delete


by an anonymous user from: Fremont, California, United States

I got one like this today:

"Hi,

I am sending you this document through Drop box as I cannot send through attachment. I am having problem attaching document to email. Please login with your email address to find the attached document for your expedite. Please view the document below and let me know as soon as possible. Apology for the inconvenience

View Document

Thank you...

Anita"

Delete


by an anonymous user from: Irvine, California, United States

Is there a way to retrieve email contacts after this happens

Delete


by an anonymous user from: Dudley, England, United Kingdom

'Chris Daverston asks to share a file with you, via "The SecureTeam File".' Another scam.

Delete


by info

Here is another scam:

"-------- Oorspronkelijk bericht --------
Van: Google Drive
Datum: 08-09-17 06:48 (GMT 01:00)
Onderwerp: New Message Google Drive

google drive icon

Google Drive

A file was shared with you Via Google drive.
Kindly download the attachment via Google drive."

Delete



by an anonymous user from: Sunnyvale, California, United States

Got one today. Do I need to change just my gmail password or passwords for everything?

Delete


by info

If you did not click on the link and attempt to sign-in to the page that you were taken to, there is no need to change your passwords.

Delete


by info

Here is another scam:

"-- Forwarded Message --
From: "rhonda.cook-cvcsd.com"
Sent: Wednesday, May 3, 2017 2:54 PM
Subject: Rhonda Cook has shared a document on Google Docs with you

Rhonda Cook has invited you to view the following document:"

Delete


by an anonymous user from: Fort Collins, Colorado, United States

This just happened to me.

Delete


by an anonymous user from: Corpus Christi, Texas, United States

"Incoming Docs Shared Via Google Docs

You have a pending incoming docs shared with you via Google docs

Click to open: e-Document

Google Docs makes it easy to create, store and share online documents, spreadsheets and presentations."

Is this a scam?

Delete


by info

Yes, it is a scam.

Delete


by an anonymous user from: Hereford, England, United Kingdom

Is a google message from www.pettocus regarding the google browser being heavily damaged by 4 virus a scam?

Delete


by info

Yes, it is a scam.

Delete


by an anonymous user from: Raleigh, North Carolina, United States

I received this message that I thought was from my boss, "I'm having problem with my email outlook; I don’t know if you have received the email I sent to you earlier. I have meeting shortly, so check and get back to me. Kind regards". There was no attachment to click on, just this message that I replied to on my gmail. What is the fallout from this kind of scam? Except getting my name and e-mail address which they already had since they e-mailed me.

Delete


by info

The trick is to get you to respond, to confirm that you have received their message. Once they have confirm that you have receive their message, they will attempt to trick you into visiting phishing that steal personal and financial information, or malicious websites that infect computers or mobile devices with viruses or malware. Or, trick you into sending money, personal or financial information.

Delete


by an anonymous user from: Didcot, England, United Kingdom

I had an email like this today:

"I tried sending you this important document earlier but noticed the failure delivery due to some technical problems so I had to re-send it via Google doc attachment for you to view it. Please login with your correct details to view the document"

The link in the message points to the hacked website:
http://kb.lawofcure .com/edited/edited/

Delete


by an anonymous user from: Atlanta, Georgia, United States

This was the link to a document sent to me (I am a real estate agent and some one sent me to their pre-approval letter to review) - It just felt wrong - I did not log in but wanted to share:

myrealestategoogldrive.atspace .cc

Delete


by info

Received the following via email message:

I received a scam in my inbox recently and confirmed it was fake and/or malicious thanks to your site. Thankfully, I'm wise enough to know what they look like and tend to save family and co-workers from handing out their bank account numbers to princes in Nigeria. I wanted to send you the email I received because the link (I NEVER clicked on it) is one that you do not have listed on your site, though the wording is very similar. Just hoping to help other people who copy and paste this stuff, especially since it is in Spanish and might not raise any flags to someone living in say, Los Angeles.

I have copied and pasted the email bodies below with dates and times. I have not included the other person's email as I'm sure it is an innocent person who was hacked and could not find anything related when I searched it online. The first email he sent to my boss, Kari, who passed it to me to handle.

Email thread:

"From:[REDACTED]
Sent: Monday, November 28, 2016 1:32 PM
Subject: Kitchen Remodeling...

Hello my name is Pedro Santos, i will like to know if you are available for kitchen remodel for my new home i just bought. Please get back to me so i can go ahead and send you more info about the job with the measurement. I will be paying in cash or with a check. Regards, Pedro."

- - -

On Mon, Nov 28, 2016 at 3:23 PM

I sent this email however, in the email thread, it reads:

On Tue, Nov 29, 2016 at 12:23 AM
Katie wrote: "Hi Pedro: Kari sent me your email regarding your new home kitchen remodel. A few questions to get us started:
1) Do you already have keys to the new home?
2) What is the address?
3) What are your goals with the kitchen remodel? (ie cabinets, flooring, backsplash, etc.)
4) Do you have a deadline everything must be completed by? Let me know so I can help you get started in the right direction.

His response Mon, Nov 28, 2016 at 7:55 PM Pacific Standard Time (my time zone):

"Thank you for getting back to me. I have sent you the measurement and samples for you to review and get back to me with the price quote and more. I sent it to you via secure Adobe document, click Here and sign in with your email to view it. Regards."

He did not sign his name and "Here" is a hyperlink with this address that I have copied:
http://tallercastillocr .com/adobee/sonto/sonto/index.html

IMPORTANT WARNING: I HAVE NOT CLICKED THIS LINK AND DO NOT KNOW WHAT IT LEADS TO. LINK PROVIDED FOR YOUR REFERENCE, RESEARCH AND PLATFORM FOR WARNING OTHERS. You may contact me if you have questions."

Delete


by an anonymous user from: Hesperia, California, United States

This has happened to me... should I change all passwords?

Delete


by info

Yes, immediately.

Delete


by an anonymous user from: Marietta, Georgia, United States

Another I believe:

"Hello,

Check here to see what I sent using doc
Thanks"

Delete


by info

Here is another malicious email:

"From: Svetlana Trefilova
Date: Mon, Sep 12, 2016 at 12:20 PM
Subject: KindlptionsDoc.Secured.docy see attached
Attachment: ptionsDoc.Secured.doc, Doc.Secured.pdf

In response to this please see enclosed document.


Best Regards,
Svetlana"

Delete


by an anonymous user from: Pomona, California, United States

This virus wants to erase the name of my contact on my phone after I call or text that person. Any advice?

Delete


by info

Install an antivirus software on your mobile device, and do a full scan.

Delete


by an anonymous user from: Denver, Colorado, United States

Here is a scam that I received:

"Dear Google User,

You have been selected as a winner of the Google Anniversary for using Google services. Find attached email with more details.

Congratulations,

Matt Brittin
CEO of Google

©2016 Google Incorporation ®"

Delete


by info

Here is another scam:

-- start of scam --
Subject: Important meeting tomorrow
From: ramya ramya (ramyaarose90-gmail.com)
Sent: Mon 7/25/16 4:17 PM
Attachments: Agenda for next meeting.html (6.5 KB)

HI ,

I’ve attached a Draft_Agenda.pdf for our emergency meeting tomorrow, Please view it and let me know if any changes/additions are required.

Thanks,


--Forwarded Message Attachment--
Login your email address below to view the document.

Email Address
Email Password
Passwords are case sensitive

Submit

To access our online secured documents page,you are required to login your email address.
Unauthorized Access is prohibited.

The Intranet Website Management Center requires Internet Explorer 6.0 or greater
© 2016 Microsoft Terms Privacy & cookies Developers English (United States)
-- end of scam --

Delete


by an anonymous user from: Houston, Texas, United States

This is one I just got from "Google Support" ( the actual address is edwarderivera- shrinenet.org):

Google

We have sent you a message:

5/27/2016
4 broken emails has been recovered and re-sent to you.

View emails
We hope you found this message to be useful. However, if you'd rather not receive future e-mails of this sort, please opt-out here.

Delete


by an anonymous user from: Iowa City, Iowa, United States

AS of 25 MAY 2016, this phishing scam is still alive and well and stealing credentials. The last example used a "tiny url..." link to take the user to the false sign-in page for Google Docs.

Delete


by an anonymous user from: London, England, United Kingdom

It's just happened to me :(

Delete


by an anonymous user from: Newark, New Jersey, United States

Here's another:

"Subject: SHARED DOCUMENT
Date: May 9, 2016 at 2:10:12 PM EDT

I've been trying to attach this document to you, but that I had to send it back through Google Doc. Click SHARED DOCUMENT See
Cheers"

Delete


by info

Here is another scam:

"From: PaNache Designer Jewelry
Date: Mon, May 9, 2016 at 10:30 AM
Subject: DOC

You have a pending incoming docs shared with you via Google docs
Click to open: eStatement

Google Docs makes it easy to create, store and share online documents, spreadsheets and presentations."

Delete


by an anonymous user from: Hereford, England, United Kingdom

The email message below is still doing the rounds this time though school Chromebooks:
"FYI Please find the enclosed document referred to the subject."
​​

Delete


by an anonymous user from: Blackpool, England, United Kingdom

We have just had our organisation targeted with this exact scam!

Delete


by an anonymous user from: Zoersel, Flanders, Belgium

I have received this new one:

"Subject : Invitation
Kindly find the file I uploaded for you HERE (http://Tiffany.nl/document/
etc"

Delete


by an anonymous user from: London, England, United Kingdom

Here is another scam:
"FYI, I have enclosed document referred to the mail subject."

Delete


by an anonymous user from: Pontiac, Michigan, United States

The message I received in my Gmail was short and sweet, and from someone I had just had a business meeting with. I clicked on the link and signed in.. no document so I replied to the sender. Not hearing back from her in a few hours, I changed my passwords, but I am worried about what else I should do. My computer is a Mac. Suggestions?


"Please find the Attached Confidential Signed Agreement,
Kindly review the Approval.

This Document is protected.

Thanks"

Delete


by info

The email message is phishing scam that steals usernames and passwords, so changing your password is only thing that you need to do.

Delete


by an anonymous user from: Edmonton, Alberta, Canada

Here is a message I received:

"Hello,

How are you? Please re-examine the documents attached for you in my Adobe drive, it is protected and I granted you access to view them, check the Cloud Here and login with your email to access documents. Kindly keep it confidential and share your thoughts..

Thanks and regards,"

Delete


by an anonymous user from: Wallingford, Connecticut, United States

Email says the following:

"I'm trying to send you some documents through attachment, but it is multiple, so I had to save it online and

shared. Please view [documents] online

Thanks

url actually takes you to http://tinyurl.com/z3h9ptw."

Then, you are asked to log in with your google login to read the messages. When you do, you go to an arts web site.

I changed all my google and associated passwords afterward. And, scanned with windows defender. Do you have any other recommended actions?

Thank you

Delete


by info

You have done more than enough.

Delete


by an anonymous user from: Wallingford, Connecticut, United States

I received this today from a client, and unfortunately clicked on the url (documents) - it took me to an arts foundation web site at http://tinyurl.com/23h9ptw. This was before I noticed the additional address line for "undisclosed recipients." That has been my clue before. So, now spent the last 4 hours scanning with Defender and resetting my google and all associated website login info. Message is below.

Any other action recommended?


"I'm trying to send you some documents through attachment, but it is multiple, so I had to save it online and shared. Please view [documents] online

Thanks "

Delete


by info

Received the following from an anonymous user:

"Just received this. Unfortunately clicked on it. Going now to change Google pw/log in.

From: Cynthia Boado [mailto:cb2893- nyu.edu]
Sent: Monday, January 4, 2016 3:18 PM
Subject: I SENT YOU A FILE

I'm trying to send you some documents through attachment, but it is multiple, so i had to save it online and

shared. Please view [documents] online

Thanks"

Delete


by an anonymous user from: San Jose, California, United States

Hello,

Recently I received an email stating:

"Subject: VIEW DOCUMENT
Body: hello I've shared a secure file document attached with Google icon
Regards...

This seems fishy :( I didn't click on it because I'm unsure."

Delete


by info

The link in the email message goes to a malicious file that will infect your computer with a virus or Trojan horse. So, please delete any email message similar to the one above.

Delete


by an anonymous user from: Dublin, Leinster, Ireland

Here is another fake and phishing Google Docs or Drive email message:

"Subject: Find Attached Documents For Your Attention

Please refer to the important document I've shared with you using Dropbox App.
Click here view
TT Scan0283.pdf
Sign in to access shared documents"

Delete


by info

Here is another Google Drive phishing scam:

"Subject: 16102015_Proposal _Letter. pdf16102015_Proposal _Letter.pdf

Hello, Please find the attached for your attention. I tried to upload and send earlier but got an error message “The file you are trying to send exceeds the 25MB attachment limit” So i had to send it using Google Drive.

Open"

Delete


by an anonymous user from: San Diego, California, United States

I'm a realtor, another 'realtor' sent me an offer for a cash buyer on a company listing. She attached the offer in the email.

It was a google doc link. I didn't suspect anything except she was sending an offer to purchase to the wrong agent. So I forwarded the offer to the correct agent. I tried to open the doc but it wasn't there..so I don't know what happened...maybe they hacked me, I don't know.

It was weird but I just thought she was being an idiot. If it was an attempt at a hack it may have worked.

Delete


by info

Do a full scan of your computer with the antivirus software installed on it.

Delete


by CherylK from: Tucson, Arizona, United States

Totally fell for this. Downloaded and attempted to open the DWG file, but since it's a CAD file could not open it (thankfully). Then got info on FB from emailer that it was a scam. Deleted everything and changed emails. Am I infected? How can I tell? And if I downloaded on a PC at work, is it going to infect Macs at home?

Email below:

"From: X*X
Sent: Thursday, October 15, 2015 7:27 AM
Subject: document

I have shared a file with you via Google Docs App.
Find it below for your quick review and perusal.

Click DOWNLOAD (http://investor-webcast.com/E-Drive4Google--KM12/) to view shared document.
Google Docs
Welcome to Google Docs. Upload and Share Your Documents Securely Sign in with your email address to view or download attachment Access your documents securel...

View on investor-webcast.com
Preview by Yahoo

Regards,"

Delete


by info

All you had to do was to change your email address password and scan your computer for malware. This because the link in the email goes to a fake or phishing Google Docs websites.

There is no sure way to tell if your computer is infected, so the best thing to do, is to do a full scan of your computer with the antivirus installed on it.

Most of the links we have seen so far, only infect computers running Microsoft Windows. But, cyber-criminals are very smart and may already have some malicious software to infect Macs.

Delete


waiting