Beware of fake "Gmail suspicious login" warnings
Posted on 15.08.2014
Malicious emails impersonating Gmail Account Services have been spotted hitting inboxes around the world, falsely claiming that the users' Gmail account has been logged into from an unrecognized device.

"Even though the email message is similar to a legitimate Gmail message, a careful user will note that the displayed e-mail address and the supposed source address did not match. Further examination of the emailís headers indicates that the email was, in fact, sent via a websiteís mail form," pointed out Trend Micro techie Jay Yaneza.

Also, all the links in the email ("Change your password", "Update your account password reset info", "Help Center"), as well as the "Check Your Account" button, lead to a HTML file hosted on Google Drive.

The file is not malicious in itself, it only detects what OS and browser the visitor uses. This allows them to be redirected to a specific website claiming that one of their plugins must be updated (here is an example for Firefox):

But while the HTML code can differentiate between different OSes and browsers, currently only Windows users are danger, as the fake updates pushed on them are backdoor trojans targeting that particular platform.

The malware steals usernames and passwords, acts like a keylogger, and can accept remote commands from the attackers.

According to Yaneza, the malware is also hosted in Google Drive, and the payloads are frequently changed.

"As these files are located on legitimate services, they are also sent via HTTPS, which helps evade some web filtering techniques," he pointed out, and added that the fact that the spam emails are sent via a compromised websiteís mailer system and an IPv6 address, email reputation services might also have a hard time spotting and blocking them.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Feb 4th