Experts reacted to a Google Docs phishing attack that hijacked Gmail accounts and spammed contact lists. Google shut down the attack but not before it affected an estimated one million users.

“The key to any social engineering attack is how well the attacker hides their malicious intent,” Brian Minick, CEO for Cincinnati-based cybersecurity firm Morphick, said. “In this case, the attacker did a great job hiding their intent by very closely associating themselves with Google.”

Morphick VP of Services and Incident Response Brian Klenke, explained, “This attack was interesting for a couple reasons. The first, it was so widespread and caused such noticeable noise and impact. Many emails rely on social engineering attempts, but it’s not often that wormable code will be this successful. By using the same language and looking familiar to a legit Google service the attacker was able to deceive the user into allowing a third party application to take control of the victims email.”

Read the full article.