Beware of fake "Gmail suspicious login" warnings
Posted on 15.08.2014
Malicious emails impersonating Gmail Account Services have been spotted hitting inboxes around the world, falsely claiming that the users' Gmail account has been logged into from an unrecognized device.

"Even though the email message is similar to a legitimate Gmail message, a careful user will note that the displayed e-mail address and the supposed source address did not match. Further examination of the email’s headers indicates that the email was, in fact, sent via a website’s mail form," pointed out Trend Micro techie Jay Yaneza.

Also, all the links in the email ("Change your password", "Update your account password reset info", "Help Center"), as well as the "Check Your Account" button, lead to a HTML file hosted on Google Drive.

The file is not malicious in itself, it only detects what OS and browser the visitor uses. This allows them to be redirected to a specific website claiming that one of their plugins must be updated (here is an example for Firefox):

But while the HTML code can differentiate between different OSes and browsers, currently only Windows users are danger, as the fake updates pushed on them are backdoor trojans targeting that particular platform.

The malware steals usernames and passwords, acts like a keylogger, and can accept remote commands from the attackers.

According to Yaneza, the malware is also hosted in Google Drive, and the payloads are frequently changed.

"As these files are located on legitimate services, they are also sent via HTTPS, which helps evade some web filtering techniques," he pointed out, and added that the fact that the spam emails are sent via a compromised website’s mailer system and an IPv6 address, email reputation services might also have a hard time spotting and blocking them.


VPN protocol flaw allows attackers to discover users' true IP address

The team running the Perfect Privacy VPN service has discovered a serious vulnerability that affects all VPN providers that offer port forwarding, and which can be exploited to reveal the real IP address of users.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Dec 1st