A phishing campaign run by the same hacking group behind the U.S. and European election cyber attacks is tricking their victims into giving up their access tokens.
Security firm Trend Micro has uncovered the ruse which begins with phishing emails that purport to be from Google that notifies recipients that their email account has experienced “unexpected sign-in attempts.” It then urges users to download a security application dubbed “Google Defender,” which instead of providing further protection serves as the foundation of the attack.
By choosing to install “Google Defender” victims are then redirected to a legitimate Google page that asks them to authorize the application.
Doing so results in giving the hacking group access to the OAuth token, which grants the application access to their account. This essentially circumvents Google’s 2-step verification feature.
