Google Docs Scam Highlights Phishing’s Low, Low Bar

The article recounts a widespread Google Docs phishing campaign in which attackers sent spoofed document invitations that led to malicious web applications (on domains such as g-cloud.win and docscloud.info) that invoked Google OAuth to request broad permissions (read/send/manage email and contacts). Thousands of users clicked the links and granted permissions before Google intervened; the incident highlights weaknesses in OAuth app spoofing, the effectiveness of social-engineering phishing, and the need for better inbox filtering, permission controls, and user training.