Google Warns Against New Phishing Attack on Gmail and YouTube Users

Background Google has issued an alert to users of Gmail and YouTube against an emerging phishing attack that poses a threat to users of these online services. Hackers use this attack vector to harvest the personal and/or sensitive data of unsuspecting individuals to perpetuate other malicious activities. Modus Operandi Gmail Account Phishing Attack: Attackers are impersonating Google’s brand to send fake emails or pop-ups beginning with the subject line “Online Reward Program”. Users who open this email or pop-up are presented with a message “Congratulations! You are a lucky Google user! “Every 10 millionth search is reached worldwide; we will proclaim a lucky user to send out a thank-you gift. You are the lucky user!”. The message then requires users to click on a specific link to redeem their prize by entering their personal information, which is then harvested. YouTube Phishing Attack: Attackers are impersonating YouTube channels to send fraudulent emails to unsuspecting users. The emails are sent from no-reply@youtube.com using subject lines such as "YouTube policy change" and "The YouTube team sent you a video." The email contains a link to the video or an attachment that leads to a fake login page where personal information is harvested or may contain malware. Recommendation Google does NOT offer spontaneous prizes in the format described above. Do NOT reply with your personal information. Do NOT reply to or click on any link or attachment from an unsolicited sender. Verify any reward programmes via mainstream media outlets such as newspapers and websites before assuming they are true. Be cautious of messages that create a sense of urgency or fear, prompting you to take immediate action or risk losing access to your account or any other offer. Contact the Cyber Security Authority The CSA has a 24-hour Cybersecurity/Cybercrime Incident Reporting Points of Contact (PoC) for reporting cybercrimes and for seeking clarification and guidance on online links and transactions;Call or Text – 292, WhatsApp – 0501603111, Email – report@csa.gov.gh Issued by Cyber Security Authority May 8, 2023