Google Docs Phishing Campaign

An aggressive phishing campaign leveraged squatted domains and a malicious web app that used Google OAuth to request permissions to read, send, delete, and manage victims' Gmail and contacts; once users granted access, the attackers used compromised accounts to send the phishing link to the victims' contacts, rapidly propagating the campaign. The report details campaign flow, screenshots of the phishing messages and OAuth prompts, ~10 newly registered domains used as IOCs, and observed traffic (over 10,000 hits in two hours), and notes Google and Zscaler mitigations.